Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.1
- Prevailion DarkWatchman 2021
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1030 | Agrius | Iran |
| grp_g0053 | FIN5 | — |
| grp_g0090 | WIRTE | — |
| grp_g1023 | APT5 | China |
| grp_g0129 | Mustang Panda | China |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0119 | Indrik Spider | Russia |
| grp_g0135 | BackdoorDiplomacy | — |
| grp_g0093 | GALLIUM | — |
| grp_g0114 | Chimera | China |
| grp_g1048 | UNC3886 | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g0102 | Wizard Spider | Russia |
| grp_g0069 | MuddyWater | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g1046 | Storm-1811 | — |
| grp_g0065 | Leviathan | China |
| grp_g0087 | APT39 | — |
| grp_g0022 | APT3 | China |
| grp_g0030 | Lotus Blossom | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g1016 | FIN13 | — |
| grp_g0139 | TeamTNT | — |
| grp_g0045 | menuPass | — |
| grp_g0007 | APT28 | Russia |
| grp_g0040 | Patchwork | — |
| grp_g0121 | Sidewinder | India |
| grp_g0027 | Threat Group-3390 | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.