Description
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Platforms
Mitigations (2)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families
Data Loss PreventionM1057
Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.
Threat Groups (27)
| ID | Group | Context |
|---|---|---|
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) transmitted collected victim host information via HTTP POST to command and control infrastructure.(... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used Web shells and [HTRAN](https://attack.mitre.org/software/S0040) for C2 and to exfiltrate data.(C... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that exfiltrates data over the C2 channel.(Citation: FireEye Clandestine Fox) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has exfiltrated data over its C2 channel.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kim... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s backdoor has exfiltrated data using the already opened channel with its C&C server.(Citation: ESET Oc... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017) |
| G0047 | Gamaredon Group | A [Gamaredon Group](https://attack.mitre.org/groups/G0047) file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gam... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016) |
| G1012 | CURIUM | [CURIUM](https://attack.mitre.org/groups/G1012) has used IMAP and SMTPS for exfiltration via tools such as [IMAPLoader](https://attack.mitre.org/softw... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has exfiltrated stolen data and files to its C2 server.(Citation: Cisco Talos MUSTANG PANDA PLU... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has exfiltrated files via the Dropbox API C2.(Citation: Zscaler APT31 Covid-19 October 2020) |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) has exfiltrated data from compromised VMware vCenter servers through an established C2 chann... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has exfiltrated stolen victim data through C2 communications.(Citation: FBI FLASH APT39 September 2020) |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has exfiltrated data from a compromised host to actor-controlled C2 servers.(Citation: S... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) exfiltrated data over its C2 channel.(Citation: Zscaler Higaisa 2020) |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) transferred compressed and encrypted RAR files containing exfiltration through the established backd... |
| G0142 | Confucius | [Confucius](https://attack.mitre.org/groups/G0142) has exfiltrated stolen files to its C2 server.(Citation: TrendMicro Confucius APT Aug 2021) |
| G0065 | Leviathan | [Leviathan](https://attack.mitre.org/groups/G0065) has exfiltrated data over its C2 channel.(Citation: CISA AA21-200A APT40 July 2021) |
| G1035 | Winter Vivern | [Winter Vivern](https://attack.mitre.org/groups/G1035) delivered a PowerShell script capable of recursively scanning victim machines looking for vario... |
| G0038 | Stealth Falcon | After data is collected by [Stealth Falcon](https://attack.mitre.org/groups/G0038) malware, it is exfiltrated over the existing C2 channel.(Citation: ... |
Associated Software (166)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can send information about the compromised host and upload data to a hardcoded C2 server.(Citation... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has sent user and system information to a C2 server via HTTP POST requests.(Citation: NHS UK BL... |
| S1145 | Pikabot | Malware | During the initial [Pikabot](https://attack.mitre.org/software/S1145) command and control check-in, [Pikabot](https://attack.mitre.org/software/S1145)... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has exfiltrated data over the C2 channel.(Citation: Unit42 Molerat Mar 2020) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can send collected data in JSON format to C2.(Citation: Google EXOTIC LILY March 2022) |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has uploaded files from the victim system to C2 servers.(Citation: CrowdStrike BRICKSTORM WARP P... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has sent victim data to its C2 servers.(Citation: BlackBerry Amadey 2020) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) performs data exfiltration over the control server channel using a custom protocol.(Citation: McAf... |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can send victim data to an actor-controlled C2 server.(Citation: McAfee Lazarus Nov 2020) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) sends compromised victim information via HTTP.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chie... |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) sends device and other collected data back to the C2 using the established C2 channels over TCP.... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) has exfiltrated collected data to its C2 via POST requests.(Citation: Mandiant Suspected Turla Ca... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) has uploaded files and data to its C2 servers.(Citation: Cylance Dust Storm) |
| S0391 | HAWKBALL | Malware | [HAWKBALL](https://attack.mitre.org/software/S0391) has sent system information and files over the C2 channel.(Citation: FireEye HAWKBALL Jun 2019) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used HTTP POSTs to exfil gathered information.(Citation: TrendMicro Ursnif Mar 2015)(Citation: F... |
| S0086 | ZLib | Malware | [ZLib](https://attack.mitre.org/software/S0086) has sent data and files from a compromised host to its C2 servers.(Citation: Cylance Dust Storm) |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has used HTTP communications to the “/Uploads” URI for file exfiltration.(Citation: Zscaler... |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) exfiltrates data over its C2 channel.(Citation: McAfee Bankshot) |
| S1089 | SharpDisco | Malware | [SharpDisco](https://attack.mitre.org/software/S1089) can load a plugin to exfiltrate stolen files to SMB shares also used in C2.(Citation: Moustached... |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) can exfiltrate collected documents through C2 channels.(Citation: Talos Promethium June 2020)(Ci... |
References
Frequently Asked Questions
What is T1041 (Exfiltration Over C2 Channel)?
T1041 is a MITRE ATT&CK technique named 'Exfiltration Over C2 Channel'. It belongs to the Exfiltration tactic(s). Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control...
How can T1041 be detected?
Detection of T1041 (Exfiltration Over C2 Channel) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1041?
There are 2 documented mitigations for T1041. Key mitigations include: Network Intrusion Prevention, Data Loss Prevention.
Which threat groups use T1041?
Known threat groups using T1041 include: BlackByte, GALLIUM, APT3, Kimsuky, APT32, MuddyWater, Gamaredon Group, Sandworm Team.