Skip to content

T1020 Automated Exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Item Value
ID T1020
Sub-techniques T1020.001
Tactics TA0010
Platforms Linux, Network, Windows, macOS
Version 1.2
Created 31 May 2017
Last Modified 19 April 2022

Procedure Examples

ID Name Description
S0438 Attor Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.7
S0050 CosmicDuke CosmicDuke exfiltrates collected files automatically over FTP to remote servers.6
S0538 Crutch Crutch has automatically exfiltrated stolen files to Dropbox.10
S0600 Doki Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.5
S0377 Ebury Ebury can automatically exfiltrate gathered SSH credentials.8
G0101 Frankenstein Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary’s C2.20
G0047 Gamaredon Group Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.16
G0072 Honeybee Honeybee performs data exfiltration is accomplished through the following command-line command: from (- --).txt.17
G0004 Ke3chang Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.18
S0395 LightNeuron LightNeuron can be configured to automatically exfiltrate files under a specified directory.12
S0409 Machete Machete’s collected files are exfiltrated automatically to remote servers.4
S0643 Peppy Peppy has the ability to automatically exfiltrate files and keylogs.14
S0090 Rover Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.15
S0445 ShimRatReporter ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.1
G0121 Sidewinder Sidewinder has configured tools to automatically send collected files to attacker controlled servers.21
S0491 StrongPity StrongPity can automatically exfiltrate collected documents to the C2 server.23
S0467 TajMahal TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.11
S0131 TINYTYPHON When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.9
G0081 Tropic Trooper Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.19
S0136 USBStealer USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. 13

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Access
DS0029 Network Traffic Network Connection Creation
DS0012 Script Script Execution

References

  1. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. ↩

  2. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020. ↩

  3. Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020. ↩

  4. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  5. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. ↩

  6. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014. ↩

  7. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020. ↩

  8. Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021. ↩

  9. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. ↩

  10. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020. ↩

  11. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩

  12. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019. ↩

  13. Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017. ↩

  14. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. ↩

  15. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016. ↩

  16. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020. ↩

  17. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018. ↩

  18. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  19. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. ↩

  20. Adamitis, D. et al. (2019, June 4). It’s alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020. ↩

  21. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021. ↩

Back to top