Exfiltration Over Alternative Protocol T1048
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other…
- Tactics
- Exfiltration
- Actors using it
- 18
- Sub-techniques
- 1
Ransomware groups reported using it
thegentlemenakiraplaynightspire
Threat actors
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- Salt TyphoonChina · 43 techniques
- TeamTNT43 techniques
- MirrorFaceChina · Earth Kasha · 37 techniques
- Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan · 34 techniques
- FIN6Magecart Group 6, ITG08, Skeleton Spider · 33 techniques
- FIN8Syssphinx · 31 techniques
- Storm-181125 techniques
- APT33Iran · HOLMIUM, Elfin, Peach Sandstorm · 23 techniques
- Play22 techniques
- CURIUMIran · Crimson Sandstorm, TA456, Tortoise Shell · 15 techniques
- Thrip4 techniques