Automated Exfiltration

ArcaneDoor included scripted exfiltration of collected data.^[2]

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.^[3]

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.^[4]

Crutch has automatically exfiltrated stolen files to Dropbox.^[5]

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.^[6]

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.^[7][8]

Empire has the ability to automatically send collected data back to the threat actors' C2.^[9]

During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.^[9]

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.^[1]

Hannotog can upload encyrpted data for exfiltration.^[10]

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.^[11]

LightNeuron can be configured to automatically exfiltrate files under a specified directory.^[12]

Machete’s collected files are exfiltrated automatically to remote servers.^[13]

OutSteel can automatically upload collected files to its C2 server.^[14]

Peppy has the ability to automatically exfiltrate files and keylogs.^[15]

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.^[16][17][18]

RedCurl has used batch scripts to exfiltrate data.^[19][20]

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.^[21]

During Salesforce Data Exfiltration, threat actors used API queries to automatically exfiltrate large volumes of data.^[22]

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.^[23]

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.^[24]

Solar can automatically exfitrate files from compromised systems.^[25]

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.^[26][27]

StrongPity can automatically exfiltrate collected documents to the C2 server.^[28][29]

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.^[30]

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.^[31]

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.^[32]

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. ^[33]

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.^[34]