MITRE ATT&CK — FreeIntelHub

T1041 — Exfiltration Over C2 Channel (Exfiltration)

Clear filter

89 articles found

Infosecurity Magazine General Microsoft Amazon Feb 19

Flaws in Popular Software Development App Extensions Allow Data Exfiltration

Four serious new vulnerabilities affect Microsoft Visual Studio Code, Cursor and Windsurf extensions, three of which remain unpatched

T1041

Infosecurity Magazine →

Infosecurity Magazine TTPs Linux Feb 9

VoidLink Malware Exhibits Multi-Cloud Capabilities and AI Code

VoidLink, a Linux-based C2 framework, facilitates credential theft, data exfiltration across clouds

T1078 T1041

Infosecurity Magazine →

Infosecurity Magazine Vulnerability Disclosure Docker Feb 3

DockerDash Exposes AI Supply Chain Weakness In Docker's Ask Gordon

DockerDash vulnerability allows RCE and data exfiltration via unverified metadata in Ask Gordon

T1041

Infosecurity Magazine →

Mandiant Blog TTPs Jan 30

Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft

Introduction Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-...

T1566 T1041

Mandiant Blog →

Mandiant Blog Phishing Jan 30

Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS

Introduction Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion.

T1566 T1041

Mandiant Blog →

Infosecurity Magazine Ransomware Jan 15

Hackers Increasingly Shun Encryption in Favour of Pure Data Theft and Extortion

While ‘traditional’ ransomware attacks remain stable, some gangs are shifting towards exploiting zero-days and supply chains to go straight to stealing data

T1041

Infosecurity Magazine →

PortSwigger Research Vulnerability Disclosure Aug 26

Inline Style Exfiltration: leaking data with chained CSS conditionals

I discovered how to use CSS to steal attribute data without selectors and stylesheet imports! This means you can now exploit CSS injection via style attributes!

T1041

PortSwigger Research →

US-CERT Alerts Advisory May 20

Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations

Summary The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint advisory to dissem...

T1041

US-CERT Alerts →

PortSwigger Research General Dec 5

Blind CSS Exfiltration: exfiltrate unknown web pages

This is a gif of the exfiltration process (We've increased the speed so you're not waiting around for 1 minute). Read on to discover how this works.

T1041

PortSwigger Research →

Initial Access

T1566 Phishing T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1190 Exploit Public-Facing Application T1133 External Remote Services T1078 Valid Accounts T1195 Supply Chain Compromise T1189 Drive-by Compromise

Execution

T1059 Command and Scripting Interpreter T1059.001 PowerShell T1203 Exploitation for Client Execution T1204 User Execution

Persistence

T1053 Scheduled Task/Job T1547 Boot or Logon Autostart Execution T1543 Create or Modify System Process

Privilege Escalation

T1548 Abuse Elevation Control Mechanism T1068 Exploitation for Privilege Escalation

Defense Evasion

T1027 Obfuscated Files or Information T1562 Impair Defenses T1070 Indicator Removal

Credential Access

T1110 Brute Force T1555 Credentials from Password Stores T1003 OS Credential Dumping T1557 Adversary-in-the-Middle T1556 Modify Authentication Process

Discovery

T1046 Network Service Discovery

Lateral Movement

T1021 Remote Services

Command and Control

T1071 Application Layer Protocol T1573 Encrypted Channel T1572 Protocol Tunneling

Exfiltration

T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service

Impact

T1486 Data Encrypted for Impact T1489 Service Stop T1498 Network Denial of Service T1491 Defacement T1529 System Shutdown/Reboot

Resource Development

T1583 Acquire Infrastructure T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information T1598 Phishing for Information