Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.1
- C2 FRAMEWORKS
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1030 | Agrius | Iran |
| grp_g0090 | WIRTE | — |
| grp_g1014 | LuminousMoth | China |
| grp_g1043 | BlackByte | — |
| grp_g0038 | Stealth Falcon | — |
| grp_g0128 | ZIRCONIUM | — |
| grp_g1035 | Winter Vivern | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0142 | Confucius | — |
| grp_g0093 | GALLIUM | — |
| grp_g0004 | Ke3chang | — |
| grp_g1015 | Scattered Spider | — |
| grp_g0114 | Chimera | China |
| grp_g0126 | Higaisa | — |
| grp_g0102 | Wizard Spider | Russia |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g1012 | CURIUM | Iran |
| grp_g1055 | VOID MANTICORE | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0065 | Leviathan | China |
| grp_g0087 | APT39 | — |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0022 | APT3 | China |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0034 | Sandworm Team | Russia |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.