Automated Exfiltration

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.^[1]

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.^[2]

Crutch has automatically exfiltrated stolen files to Dropbox.^[3]

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.^[4]

Ebury can automatically exfiltrate gathered SSH credentials.^[5]

Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.^[6]

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.^[7]

Honeybee performs data exfiltration is accomplished through the following command-line command: from (- --).txt.^[8]

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.^[9]

LightNeuron can be configured to automatically exfiltrate files under a specified directory.^[10]

Machete’s collected files are exfiltrated automatically to remote servers.^[11]

Peppy has the ability to automatically exfiltrate files and keylogs.^[12]

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.^[13]

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.^[14]

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.^[15]

StrongPity can automatically exfiltrate collected documents to the C2 server.^[16][17]

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.^[18]

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.^[19]

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.^[20]

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. ^[21]