Skip to content

T1039 Data from Network Shared Drive

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Item Value
ID T1039
Sub-techniques
Tactics TA0009
Platforms Linux, Windows, macOS
Version 1.3
Created 31 May 2017
Last Modified 30 March 2023

Procedure Examples

ID Name Description
G0007 APT28 APT28 has collected files from network shared drives.6
S0128 BADNEWS When it first starts, BADNEWS crawls the victim’s mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.4
G0060 BRONZE BUTLER BRONZE BUTLER has exfiltrated files stolen from file shares.11
C0015 C0015 During C0015, the threat actors collected files from network shared drives prior to network encryption.12
G0114 Chimera Chimera has collected data of interest from network shares.7
S0050 CosmicDuke CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.1
S0554 Egregor Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.2
G0117 Fox Kitten Fox Kitten has searched network shares to access sensitive documents.5
G0047 Gamaredon Group Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.8
G0045 menuPass menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.9
S0458 Ramsay Ramsay can collect data from network drives and stage it for exfiltration.3
G0054 Sowbug Sowbug extracted Word documents from a file server on a victim network.10

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Access
DS0033 Network Share Network Share Access
DS0029 Network Traffic Network Connection Creation

References

  1. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014. ↩

  2. NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020. ↩

  3. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. ↩

  4. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. ↩

  5. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  6. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  7. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. ↩

  8. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020. ↩

  9. PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. ↩

  10. Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017. ↩

  11. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018. ↩

  12. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩