Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1043 | BlackByte | — |
| grp_g1057 | ShinyHunters | — |
| grp_g1052 | Contagious Interview | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0059 | Magic Hound | Iran |
| grp_g0007 | APT28 | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.