Exfiltration Over C2 Channel

ADVSTORESHELL exfiltrates data over the same channel used for C2.^[1]

AppleJeus has exfiltrated collected host information to a C2 server.^[2]

AppleSeed can exfiltrate files via the C2 channel.^[3]

APT3 has a tool that exfiltrates data over the C2 channel.^[4]

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.^[5]

APT39 has exfiltrated stolen victim data through C2 communications.^[6]

Astaroth exfiltrates collected information from its r1.log file to the external C2 server. ^[7]

Attor has exfiltrated data over the C2 channel.^[8]

Adversaries can direct BACKSPACE to upload files to the C2 Server.^[9]

Bandook can upload files from a victim's machine over the C2 channel.^[10]

Bankshot exfiltrates data over its C2 channel.^[11]

Bisonal has added the exfiltrated data to the URL over the C2 channel.^[12]

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.^[13][14]

BLUELIGHT has exfiltrated data over its C2 channel.^[15]

BoxCaon uploads files and data from a compromised host over the existing C2 channel.^[16]

CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.^[17]

Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.^[18]

Carberp has exfiltrated data via HTTP to already established C2 servers.^[19][20]

Caterpillar WebShell can upload files over the C2 channel.^[21]

CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.^[22]

Chimera has used Cobalt Strike C2 beacons for data exfiltration.^[23]

Confucius has exfiltrated stolen files to its C2 server.^[24]

Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).^[25]

Cyclops Blink has the ability to upload exfiltrated files to a C2 server.^[26]

Doki has used Ngrok to establish C2 and exfiltrate data.^[27]

Drovorub can exfiltrate files over C2 infrastructure.^[28]

DustySky has exfiltrated data to the C2 server.^[29]

Dyre has the ability to send information staged on a compromised host externally to C2.^[30]

Ebury can exfiltrate SSH credentials through custom DNS queries.^[31]

Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers. ^[32]

Empire can send data gathered from a target through the command and control channel.^[33]

EVILNUM can upload files over the C2 channel from the infected host.^[34]

Flagpro has exfiltrated data to the C2 server.^[35]

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.^[36]

Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.^[37]

GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.^[38]

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.^[39]

GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.^[40]

GoldMax can exfiltrate files over the existing C2 channel.^[41][42]

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.^[43]

Grandoreiro can send data it retrieves to the C2 server.^[44]

GrimAgent has sent data related to a compromise host over its C2 channel.^[45]

HAWKBALL has sent system information and files over the C2 channel.^[46]

Higaisa exfiltrated data over its C2 channel.^[47]

HOPLIGHT has used its C2 channel to exfiltrate data.^[48]

HotCroissant has the ability to download files from the infected host to the command and control (C2) server.^[49]

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.^[50]

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.^[51]

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.^[52]

Kessel has exfiltrated information gathered from the infected system to the C2 server.^[53]

KGH_SPY can exfiltrate collected information from the host to the C2 server.^[54]

Kimsuky has exfiltrated data over its C2 channel.^[55][56]

KONNI has sent data and files to its C2 server.^[57][58][59]

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.^{[60][61][62][63]}

Leviathan has exfiltrated data over its C2 channel.^[64]

LightNeuron exfiltrates data over its email C2 channel.^[65]

LitePower can send collected data, including screenshots, over its C2 channel.^[66]

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.^[67]

Machete's collected data is exfiltrated over the same channel used for C2.^[68]

MarkiRAT can exfiltrate locally stored data via its C2.^[69]

MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.^[70]

Metamorfo can send the data it collects to the C2 server.^[71]

MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.^[17]

MuddyWater has used C2 infrastructure to receive exfiltrated data.^[72]

NETEAGLE is capable of reading files over the C2 channel.^[9]

njRAT has used HTTP to receive stolen information from the infected machine.^[73]

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.^[74]

Data exfiltration is done by Okrum using the already opened channel with the C2 server.^[75]

OopsIE can upload files from the victim's machine to its C2 server.^[76]

Operation Wocao has used the Xserver backdoor to exfiltrate data.^[77]

Penquin can execute the command code do_upload to send files to C2.^[78]

PoetRAT has exfiltrated data over the C2 channel.^[79]

PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.^[80]

Proxysvc performs data exfiltration over the control server channel using a custom protocol.^[81]

Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.^[17]

Pteranodon exfiltrates screenshot files to its C2 server.^[39]

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.^[82]

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.^[83]

RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.^[84]

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.^[85]

REvil can exfiltrate host and malware information to C2 servers.^[86]

Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.^[87]

ROKRAT can send collected files back over same C2 channel.^[88]

Sandworm Team has sent system information to its C2 server using HTTP.^[89]

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.^[90]

SideTwist has exfiltrated data over its C2 channel.^[91]

SILENTTRINITY can transfer files from an infected host to the C2 server.^[92]

Sliver can exfiltrate files from the victim using the download command.^[93]

SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.^[94]

SMOKEDHAM has exfiltrated data to its C2 server.^[95]

Spark has exfiltrated data over the C2 channel.^[96]

After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.^[97]

StrongPity can exfiltrate collected documents through C2 channels.^[98][99]

Stuxnet sends compromised victim information via HTTP.^[100]

TajMahal has the ability to send collected files over its C2.^[101]

ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.^[102][103]

Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.^[104]

Torisma can send victim data to an actor-controlled C2 server.^[63]

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.^[105][106]

Ursnif has used HTTP POSTs to exfil gathered information.^{[107][108][109]}

Valak has the ability to exfiltrate data over the C2 channel.^{[110][111][112]}

WarzoneRAT can send collected victim data to its C2 server.^[113]

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.^[114]

XCSSET exfiltrates data stolen from a system over its C2 channel.^[115]

Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.^[116][117]

ZIRCONIUM has exfiltrated files via the Dropbox API C2.^[118]

Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. ^[119]