Procedure examples

Indrik Spider has stored collected data in a .tmp file.

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.

APT3 has been known to stage files for exfiltration in a single location.

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\. Kimsuky has also gathered data in structured directories prior to exfiltration under the %TEMP% environment variable.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.

Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.

TeamTNT has aggregated collected credentials in text files before exfiltrating.

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

APT39 has utilized tools to aggregate data prior to exfiltration.

UNC3886 has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.

Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.

Chimera has staged stolen data locally on compromised hosts.

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

APT28 has stored captured credential information in a file named pi.log.

APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.

Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.

WIRTE has staged collected documents of interest in `C:\Users\Public folder`.

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.