Procedure examples

StrongPity can automatically exfiltrate collected documents to the C2 server.

Hannotog can upload encyrpted data for exfiltration.

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.

Machete’s collected files are exfiltrated automatically to remote servers.

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.

LightNeuron can be configured to automatically exfiltrate files under a specified directory.

Peppy has the ability to automatically exfiltrate files and keylogs.

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Crutch has automatically exfiltrated stolen files to Dropbox.

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.

Solar can automatically exfitrate files from compromised systems.

OutSteel can automatically upload collected files to its C2 server.

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.

Empire has the ability to automatically send collected data back to the threat actors' C2.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.