Automated Exfiltration

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.

Kimsuky has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.

RedCurl has used batch scripts to exfiltrate data.

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.

Crutch has automatically exfiltrated stolen files to Dropbox.

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.

Empire has the ability to automatically send collected data back to the threat actors' C2.

Hannotog can upload encyrpted data for exfiltration.

LightNeuron can be configured to automatically exfiltrate files under a specified directory.

ArcaneDoor included scripted exfiltration of collected data.

During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.

During Salesforce Data Exfiltration, threat actors used API queries to automatically exfiltrate large volumes of data.