#T1041 Exfiltration Over C2 Channel

Technique

  • Tactics: Exfiltration
  • Description:

    Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

  • First Seen: Lazarus Group • 2017-05-31
MITRE ATT&CK

Tagged Reports

2026-06-16
ESTSecurity
#ContagiousInterview #NPM #SupplyChain #T1195 #T1036 #T1059.007 #T1105 #T1041 #T1027 #T1584.006
2026-05-28
Levelblue
#SapphireSleet #Bluenoroff #UNC1069 #macOS #Cryptocurrency #Phishing #T1059.002 #T1059.004 #T1105 #T1005 #T1560 #T1041 #T1543.004
2026-05-27
ENKI
#HttpSpy #JSONPing #Kimsuky #T1566 #T1059.007 #T1204.002 #T1547.001 #T1053.005 #T1027.009 #T1027.010 #T1027.013 #T1140 #T1620 #T1497.001 #T1055.001 #T1071.001 #T1132.001 #T1573.001 #T1113 #T1041 #T1636.004
2026-05-22
Dshield
#NPM #OtterCookie #T1059.007 #T1005 #T1041 #T1071.001 #T1555.003
2026-05-14
Kaspersky
#Kimsuky #APT43 #RubySleet #BlackBanshee #SparklingPisces #VelvetChollima #Springtail #PebbleDash #AppleSeed #HappyDoor #HttpTroy #VSCode #GitHub #Phishing #JSE #ADS #T1566.001 #T1059.001 #T1059.003 #T1105 #T1053.005 #T1547.001 #T1543.003 #T1219 #T1027 #T1005 #T1113 #T1056.001 #T1041 #T1071.001
#Kimsuky #Phishing #T1102.002 #T1059.005 #T1027 #T1583.006 #T1566.003 #T1567 #T1583.003 #T1204.004 #T1057 #T1082 #T1518.001 #T1568.001 #T1566.001 #T1547.001 #T1585.002 #T1140 #T1056.003 #T1204.001 #T1053.005 #T1539 #T1041 #T1113 #T1608.005 #T1608.001 #T1204.002 #T1598.003 #T1071.001 #T1590.005 #T1115 #T1083 #T1583.001 #T1059.001 #T1497 #T1056.001 #T1566.002 #T1036.005
#CHM #Kimsuky #T1518.001 #T1115 #T1566.001 #T1083 #T1041 #T1059.001 #T1053 #T1132.001 #T1059.005 #T1204.002 #T1036.005 #T1056.001 #T1071.001 #T1140 #T1057 #T1082
2026-04-07
Panther
#ContagiousTrader #NPM #OtterCookie #T1005 #T1059.007 #T1083 #T1195.002 #T1041 #T1098.004 #T1059.004 #T1027 #T1036.005 #T1656 #T1071.001 #T1082
2026-04-04
Resecurity
#Axios #NPM #T1041 #T1195 #T1027 #T1071 #T1003 #T1059 #T1082
2026-04-03
Panther
#FamousChollima #NPM #T1059.007 #T1041 #T1132.001 #T1555.003 #T1001 #T1497.001 #T1480 #T1205
2026-03-31
OSM
#TasksJacker #VSCode #T1059.007 #T1070.004 #T1036 #T1041 #T1543 #T1555 #T1059.004 #T1027 #T1102.001 #T1071.001 #T1552.004 #T1195.001
#TraderTraitor #T1059.007 #T1082 #T1036 #T1041 #T1008 #T1027 #T1070.009 #T1622 #T1573.001 #T1571 #T1497.003 #T1102.001 #T1583.003 #T1195.001
2026-03-10
Cyble
#Wagemole #T1005 #T1059.006 #T1059.007 #T1083 #T1041 #T1560 #T1195 #T1027 #T1204.002 #T1555.003 #T1566.003 #T1071.001 #T1082
2026-01-23
Red Asgard
#Lazarus #VSCode #T1059.007 #T1041 #T1555 #T1204.002 #T1566.003 #T1102.001
2026-01-21
Darktrace
#JSE #VSCode #T1566.001 #T1041 #T1090 #T1027 #T1204.002 #T1218 #T1105 #T1059
« Back