Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.^[1][2][3]

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.^[4]

APT33 has used FTP to exfiltrate files (separately from the C2 channel).^[5]

BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.^[6]

Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.^[7]

Carbon uses HTTP to send data to the C2 server.^[8]

Cherry Picker exfiltrates files over FTP.^[9]

CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.^[10]

CORALDECK has exfiltrated data in HTTP POST headers.^[11]

CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.^[12]

Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.^[13]

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.^[14]

FIN8 has used FTP to exfiltrate collected data.^[15]

FTP may be used to exfiltrate data separate from the main command and control protocol.^[16]

Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.^[17]

KONNI has used FTP to exfiltrate reconnaissance data out.^[18]

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.^[19][20]

OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.^[21]

PoetRAT has used FTP for exfiltration.^[22]

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.^[23]

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.^[24]

WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.^[25]

Wizard Spider has exfiltrated victim information using FTP.^[26][27]

Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.

Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.^[28]