#T1041 Exfiltration Over C2 Channel

Technique

  • Tactics: Exfiltration
  • Description:

    Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

  • First Seen: Lazarus Group • 2017-05-31
MITRE ATT&CK

Tagged Reports

2025-06-03
ENKI
#ITWorker #T1222.001 #T1059.003 #T1059.007 #T1027.010 #T1041 #T1657 #T1573.001 #T1571 #T1102 #T1055.009 #T1071.001 #T1140 #T1565.001 #T1132
2025-04-23
Huntabil
#macOS #T1005 #T1518 #T1041 #T1059.004 #T1566.002 #T1547.001 #T1071.001 #T1059 #T1057 #T1082
2025-04-23
Navneet
#Konni #LNK #T1005 #T1059.003 #T1070.004 #T1566.001 #T1041 #T1059.001 #T1059.005 #T1027 #T1573.001 #T1547.001 #T1071.001 #T1140
2025-04-04
Seqrite
#Kimsuky #LNK #T1566.001 #T1041 #T1059.001 #T1059.005 #T1555.003 #T1056.001 #T1547.001 #T1071.001 #T1140 #T1082
2025-04-01
ENKI
#Somansa #T1134.002 #T1106 #T1592 #T1132.002 #T1057 #T1082 #T1134.001 #T1565.001 #T1059.003 #T1069.001 #T1553.002 #T1485 #T1573.001 #T1140 #T1030 #T1070.004 #T1027.007 #T1041 #T1113 #T1027.008 #T1046 #T1590.005 #T1083 #T1033 #T1070.006
2025-03-28
Cyfirma
#Konni #LNK #T1005 #T1082 #T1566 #T1041 #T1485 #T1068 #T1027 #T1547.001 #T1059 #T1003
2025-03-10
Socket
#Lazarus #NPM #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1105 #T1657 #T1217 #T1195.002
2025-02-20
ESET
#BeaverTail #DeceptiveDevelopment #InvisibleFerret #T1025 #T1567.004 #T1555.001 #T1027.013 #T1016 #T1071.002 #T1566.003 #T1564.003 #T1552.001 #T1583.003 #T1082 #T1614 #T1119 #T1059.003 #T1074.001 #T1140 #T1030 #T1585.001 #T1005 #T1059.007 #T1587.001 #T1041 #T1564.001 #T1010 #T1219 #T1608.001 #T1204.002 #T1571 #T1071.001 #T1059.006 #T1115 #T1083 #T1124 #T1555.003 #T1056.001 #T1133 #T1021.001 #T1095 #T1560.002 #T1657 #T1217
2025-02-12
Cyfirma
#APT43 #T1055.012 #T1562.001 #T1190 #T1587 #T1543.003 #T1059.003 #T1074.001 #T1553.002 #T1591 #T1218.011 #T1587.001 #T1588.005 #T1598.003 #T1594 #T1218.010 #T1557 #T1007 #T1583.001 #T1555.003 #T1036 #T1012 #T1016 #T1059.005 #T1027 #T1071.002 #T1027.002 #T1562.004 #T1111 #T1003.001 #T1140 #T1585.001 #T1005 #T1114.003 #T1053.005 #T1608.001 #T1105 #T1114.002 #T1589.002 #T1036.005 #T1534 #T1078.003 #T1552.001 #T1560.001 #T1136.001 #T1057 #T1082 #T1550.002 #T1518.001 #T1176 #T1566.001 #T1071.003 #T1585.002 #T1588.002 #T1036.004 #T1204.001 #T1586.002 #T1041 #T1219 #T1589.003 #T1071.001 #T1564.002 #T1112 #T1218.005 #T1059.001 #T1593.001 #T1040 #T1546.001 #T1056.001 #T1070.006 #T1102.002 #T1583.006 #T1564.003 #T1098 #T1593.002 #T1547.001 #T1567.002 #T1059.007 #T1070.004 #T1560.003 #T1505.003 #T1583.004 #T1204.002 #T1055 #T1059.006 #T1083 #T1133 #T1566.002 #T1021.001 #T1584.001
2025-02-07
Rayssa Cardoso
#ClickFix #ContagiousInterview #Lazarus #T1546.008 #T1041 #T1564.001 #T1016 #T1555 #T1027 #T1204.002 #T1033 #T1555.003 #T1056.001 #T1027.002 #T1082
2024-11-06
David_Jou
#APT37 #CVE-2024-38178 #VeilShell #T1069 #T1027 #T1071 #T1057 #T1082 #T1574 #T1566 #T1140 #T1030 #T1041 #T1555 #T1560 #T1132 #T1055 #T1547 #T1070 #T1112 #T1053 #T1033 #T1204 #T1059 #T1003
2024-11-04
Zscaler
#BeaverTail #ContagiousInterview #InvisibleFerret #Wagemole #T1005 #T1059.006 #T1059.007 #T1083 #T1041 #T1027.013 #T1555.003 #T1204.002 #T1071.002 #T1566.003 #T1560.001 #T1071.001 #T1082
2024-10-03
Securonix
#APT37 #VeilShell #ShroudedSleep #T1069 #T1027 #T1057 #T1082 #T1566.001 #T1547.001 #T1204.001 #T1059.007 #T1070.004 #T1041 #T1560 #T1555 #T1204.002 #T1132 #T1112 #T1059.001 #T1053 #T1033 #T1574.014 #T1003
2024-09-12
Cyfirma
#Kimsuky #T1055.012 #T1562.001 #T1190 #T1587 #T1543.003 #T1059.003 #T1074.001 #T1553.002 #T1591 #T1218.011 #T1587.001 #T1588.005 #T1598.003 #T1594 #T1218.010 #T1557 #T1007 #T1583.001 #T1555.003 #T1036 #T1012 #T1016 #T1059.005 #T1027 #T1071.002 #T1027.002 #T1562.004 #T1111 #T1003.001 #T1140 #T1585.001 #T1005 #T1114.003 #T1053.005 #T1608.001 #T1105 #T1114.002 #T1589.002 #T1036.005 #T1534 #T1078.003 #T1552.001 #T1560.001 #T1136.001 #T1057 #T1082 #T1550.002 #T1518.001 #T1176 #T1566.001 #T1071.003 #T1585.002 #T1588.002 #T1036.004 #T1204.001 #T1586.002 #T1041 #T1219 #T1589.003 #T1071.001 #T1564.002 #T1112 #T1218.005 #T1059.001 #T1593.001 #T1040 #T1546.001 #T1056.001 #T1070.006 #T1102.002 #T1583.006 #T1564.003 #T1098 #T1593.002 #T1547.001 #T1567.002 #T1059.007 #T1070.004 #T1560.003 #T1505.003 #T1583.004 #T1204.002 #T1055 #T1059.006 #T1083 #T1133 #T1566.002 #T1021.001 #T1584.001
2024-08-22
S2W
#LINKON #AutoIt #puNK-003 #CURKON #LNK #LilithRAT #puNK-002 #puNK-001 #T1518.001 #T1059.003 #T1027.010 #T1053.005 #T1059.001 #T1564.001 #T1539 #T1041 #T1555.003 #T1204.002 #T1564.003 #T1571 #T1547.001 #T1105
« Back