Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1005 | POLONIUM | — |
| grp_g1014 | LuminousMoth | China |
| grp_g0128 | ZIRCONIUM | — |
| grp_g0129 | Mustang Panda | China |
| grp_g1001 | HEXANE | — |
| grp_g0142 | Confucius | — |
| grp_g1024 | Akira | — |
| grp_g1021 | Cinnamon Tempest | China |
| grp_g0119 | Indrik Spider | Russia |
| grp_g1051 | Medusa Group | — |
| grp_g1015 | Scattered Spider | — |
| grp_g0114 | Chimera | China |
| grp_g0102 | Wizard Spider | Russia |
| grp_g1053 | Storm-0501 | — |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g0065 | Leviathan | China |
| grp_g0046 | FIN7 | — |
| grp_g0010 | Turla | Russia |
| grp_g0125 | HAFNIUM | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g1003 | Ember Bear | Russia |
| grp_g1006 | Earth Lusca | China |
| grp_g1022 | ToddyCat | — |
| grp_g0027 | Threat Group-3390 | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.