Exfiltration Over C2 Channel

ADVSTORESHELL exfiltrates data over the same channel used for C2.^[1]

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.^[2]

Amadey has sent victim data to its C2 servers.^[3]

AppleJeus has exfiltrated collected host information to a C2 server.^[4]

AppleSeed can exfiltrate files via the C2 channel.^[5]

APT3 has a tool that exfiltrates data over the C2 channel.^[6]

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.^[7]

APT39 has exfiltrated stolen victim data through C2 communications.^[8]

Astaroth exfiltrates collected information from its r1.log file to the external C2 server. ^[9]

Attor has exfiltrated data over the C2 channel.^[10]

AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.^[11]

Adversaries can direct BACKSPACE to upload files to the C2 Server.^[12]

BADHATCH can exfiltrate data over the C2 channel.^[13][14]

Bandook can upload files from a victim's machine over the C2 channel.^[15]

Bankshot exfiltrates data over its C2 channel.^[16]

Bisonal has added the exfiltrated data to the URL over the C2 channel.^[17]

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.^[18][19]

BLUELIGHT has exfiltrated data over its C2 channel.^[20]

BoxCaon uploads files and data from a compromised host over the existing C2 channel.^[21]

Bumblebee can send collected data in JSON format to C2.^[22]

During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.^[23]

CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.^[24]

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.^[25]

Carberp has exfiltrated data via HTTP to already established C2 servers.^[26][27]

Caterpillar WebShell can upload files over the C2 channel.^[28]

CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.^[29]

Chimera has used Cobalt Strike C2 beacons for data exfiltration.^[30]

CHIMNEYSWEEP can upload collected files to the command-and-control server.^[31]

Chrommme can exfiltrate collected data via C2.^[32]

Confucius has exfiltrated stolen files to its C2 server.^[33]

CreepySnail can connect to C2 for data exfiltration.^[34]

Crimson can exfiltrate stolen information over its C2.^[35]

Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).^[36]

Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.^[37]

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.^[38]

Cyclops Blink has the ability to upload exfiltrated files to a C2 server.^[39]

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.^[40]

DnsSystem can exfiltrate collected data to its C2 server.^[41]

Doki has used Ngrok to establish C2 and exfiltrate data.^[42]

Drovorub can exfiltrate files over C2 infrastructure.^[43]

DUSTTRAP can exfiltrate collected data over C2 channels.^[44]

DustySky has exfiltrated data to the C2 server.^[45]

Dyre has the ability to send information staged on a compromised host externally to C2.^[46]

Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's known_host files and wtmp records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command Xcat to send the process's ssh session's credentials to the C2 server.^[47][48]

Emotet has exfiltrated data over its C2 channel.^[49][50]

Empire can send data gathered from a target through the command and control channel.^[51][52]

EVILNUM can upload files over the C2 channel from the infected host.^[53]

Flagpro has exfiltrated data to the C2 server.^[54]

FlawedAmmyy has sent data collected from a compromised host to its C2 servers.^[55]

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.^[56]

During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.^[52]

FunnyDream can execute commands, including gathering user information, and send the results to C2.^[57]

GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.^[58]

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.^[59]

GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.^[60]

GoldMax can exfiltrate files over the existing C2 channel.^[61][62]

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.^[63]

Grandoreiro can send data it retrieves to the C2 server.^[64]

GrimAgent has sent data related to a compromise host over its C2 channel.^[65]

HAWKBALL has sent system information and files over the C2 channel.^[66]

Higaisa exfiltrated data over its C2 channel.^[67]

During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.^[68]

HOPLIGHT has used its C2 channel to exfiltrate data.^[69]

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.^[70]

IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.^[71]

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.^[72]

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.^[73]

IPsec Helper exfiltrates specific files through its command and control framework.^[74]

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.^[75]

Kessel has exfiltrated information gathered from the infected system to the C2 server.^[76]

Kevin can send data from the victim host through a DNS C2 channel.^[77]

KGH_SPY can exfiltrate collected information from the host to the C2 server.^[78]

Kimsuky has exfiltrated data over its C2 channel.^[79][80]

KONNI has sent data and files to its C2 server.^[81][82][83]

KOPILUWAK has exfiltrated collected data to its C2 via POST requests.^[84]

Latrodectus can exfiltrate encrypted system information to the C2 server.^[85][86]

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.^[87][88][89]

Leviathan has exfiltrated data over its C2 channel.^[90]

LightNeuron exfiltrates data over its email C2 channel.^[91]

LitePower can send collected data, including screenshots, over its C2 channel.^[92]

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.^[93]

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.^[94]

LunarMail can use email image attachments with embedded data for receiving C2 commands and data exfiltration.^[95]

Machete's collected data is exfiltrated over the same channel used for C2.^[96]

MacMa exfiltrates data from a supplied path over its C2 channel.^[97]

Mafalda can send network system data and files to its C2 server.^[98]

Manjusaka data exfiltration takes place over HTTP channels.^[99]

MarkiRAT can exfiltrate locally stored data via its C2.^[100]

MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.^[101]

metaMain can upload collected files and data to its C2 server.^[102]

Metamorfo can send the data it collects to the C2 server.^[103]

Mis-Type has transmitted collected files and data to its C2 server.^[104]

Misdat has uploaded files and data to its C2 servers.^[104]

Mispadu can sends the collected financial data to the C2 server.^[105][106]

MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.^[24]

Mongall can upload files and information from a compromised host to its C2 server.^[107]

MuddyWater has used C2 infrastructure to receive exfiltrated data.^[108]

NETEAGLE is capable of reading files over the C2 channel.^[12]

NightClub can use SMTP and DNS for file exfiltration and C2.^[109]

njRAT has used HTTP to receive stolen information from the infected machine.^[110]

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.^[111]

Data exfiltration is done by Okrum using the already opened channel with the C2 server.^[112]

OopsIE can upload files from the victim's machine to its C2 server.^[113]

During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.^[114]

During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.^[115]

During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.^[116]

OutSteel can upload files from a compromised host over its C2 channel.^[117]

PcShare can upload files and information from a compromised host to its C2 servers.^[57]

Penquin can execute the command code do_upload to send files to C2.^[118]

During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.^[119]

PingPull has the ability to exfiltrate stolen victim data through its C2 channel.^[120]

PoetRAT has exfiltrated data over the C2 channel.^[121]

PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.^[122]

Proxysvc performs data exfiltration over the control server channel using a custom protocol.^[123]

Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.^[24]

Pteranodon exfiltrates screenshot files to its C2 server.^[59]

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.^[124]

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.^[125]

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.^{[126][127][128]}

RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.^[129]

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.^[130]

REvil can exfiltrate host and malware information to C2 servers.^[131]

Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.^[132]

ROKRAT can send collected files back over same C2 channel.^[133]

RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP. ^[134]

S-Type has uploaded data and files from a compromised host to its C2 servers.^[104]

Sandworm Team has sent system information to its C2 server using HTTP.^[135]

SDBbot has sent collected data from a compromised host to its C2 servers.^[55]

Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.^[136]

SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.^[109]

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.^[137]

SideTwist has exfiltrated data over its C2 channel.^[138]

SILENTTRINITY can transfer files from an infected host to the C2 server.^[139]

Sliver can exfiltrate files from the victim using the download command.^[140]

SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.^[141]

SMOKEDHAM has exfiltrated data to its C2 server.^[142]

SombRAT has uploaded collected data and files from a compromised host to its C2 server.^[143]

Spark has exfiltrated data over the C2 channel.^[144]

Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.^[145]

STARWHALE can exfiltrate collected data to its C2 servers.^[146]

After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.^[147]

StrifeWater can send data and files from a compromised host to its C2 server.^[148]

StrongPity can exfiltrate collected documents through C2 channels.^[149][150]

Stuxnet sends compromised victim information via HTTP.^[151]

SUGARDUMP has sent stolen credentials and other data to its C2 server.^[152]

SVCReady can send collected data in JSON format to its C2 server.^[153]

SysUpdate has exfiltrated data over its C2 channel.^[154]

TajMahal has the ability to send collected files over its C2.^[155]

ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.^[156][157]

Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.^[158]

Torisma can send victim data to an actor-controlled C2 server.^[159]

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.^[160][161]

Ursnif has used HTTP POSTs to exfil gathered information.^{[162][163][164]}

Valak has the ability to exfiltrate data over the C2 channel.^{[165][166][167]}

WarzoneRAT can send collected victim data to its C2 server.^[168]

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.^[169]

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.^[170][171]

Woody RAT can exfiltrate files from an infected machine to its C2 server.^[172]

XCSSET exfiltrates data stolen from a system over its C2 channel.^[173]

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.^[174][175]

ZIRCONIUM has exfiltrated files via the Dropbox API C2.^[176]

ZLib has sent data and files from a compromised host to its C2 servers.^[104]

Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. ^[177]