Exfiltration Over C2 Channel

AbstractEmu can send large amounts of device data over its C2 channel, including the device’s manufacturer, model, version and serial number, telephone number, and IP address.^[1]

AhRat can exfiltrate collected data to the C2, such as audio recordings and files.^[2]

BOULDSPY has exfiltrated cached data from infected devices.^[3]

BRATA has exfiltrated data to the C2 server using HTTP requests.^[4]

During C0033, PROMETHIUM used StrongPity to exfiltrate to the C2 server using HTTPS.^[5][6]

Chameleon can send stolen data over HTTP.^[7]

Drinik can send stolen data back to the C2 server.^[8]

eSurv has exfiltrated data using HTTP PUT requests.^[9]

Fakecalls can send exfiltrated data back to the C2 server.^[10]

FluBot can send contact lists to its C2 server.^[11]

FlyTrap can use HTTP to exfiltrate data to the C2 server.^[12]

GoldenEagle has exfiltrated data via both SMTP and HTTP.^[13]

GolfSpy exfiltrates data using HTTP POST requests.^[14]

Hornbill can exfiltrate data back to the C2 server using HTTP.^[15]

During Operation Dust Storm, the threat actors used Android backdoors that would send information and data from a victim's mobile device to the C2 servers.^[16]

Pallas exfiltrates data using HTTP.^[17]

RedDrop uses standard HTTP for exfiltration.^[18]

SharkBot can exfiltrate captured user credentials and event logs back to the C2 server. ^[19]

Sunbird can exfiltrate compressed ZIP files containing gathered info to C2 infrastructure.^[15]

Triada utilized HTTP to exfiltrate data through POST requests to the command and control server.^[20]

ViceLeaker uses HTTP data exfiltration.^[21][22]

XLoader for iOS has exfiltrated data using HTTP requests.^[23]