- Home
- Techniques
- Enterprise
- Automated Exfiltration
Automated Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Procedure Examples
| Name | Description |
|---|---|
| Attor |
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.[8] |
| CosmicDuke |
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.[2] |
| Frankenstein |
Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.[11] |
| Honeybee |
Honeybee performs data exfiltration is accomplished through the following command-line command: |
| LightNeuron |
LightNeuron can be configured to automatically exfiltrate files under a specified directory.[6] |
| Machete |
Machete’s collected files are exfiltrated automatically to remote servers.[7] |
| Rover |
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.[4] |
| ShimRatReporter |
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.[1] |
| TajMahal |
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.[9] |
| TINYTYPHON |
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.[3] |
| Tropic Trooper |
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.[12] |
| USBStealer |
USBStealer automatically exfiltrates collected files via removable media when an infected device is connected to the second victim after receiving commands from the first victim.[5] |
Mitigations
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Detection
Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.
References
- Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
- F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
- Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
- Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.
- Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
- Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
- ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
- Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
- GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
- Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
- Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
- Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.