View on MITRE ATT&CK

T1567.002 - Exfiltration to Cloud Storage

Sub-technique
Tattiche:
Exfiltration
Piattaforme:
ESXi Linux macOS Windows
Rilevamento:
Not specified
Description:
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Usato da Attori (20)
Turla
Nation-state
FIN7
Criminal
Kimsuky
Nation-state
MUSTANG PANDA
Nation-state
INDRIK SPIDER
Unknown
WIZARD SPIDER
Nation-state
HAFNIUM
Unknown
ToddyCat
Unknown
POLONIUM
Nation-state
Earth Lusca
Unknown
Scattered Spider
Unknown
Storm-0501
Unknown
LuminousMoth
Unknown
Medusa Group
Unknown
Ember Bear
Unknown
Cinnamon Tempest
Unknown
HEXANE
Unknown
Leviathan
Unknown
Akira
Unknown
Chimera
Unknown
Malware (15)
RainyDay other HAMMERTOSS other ODAgent other ROKRAT other Clambling other CreepyDrive other BoxCaon other Crutch other OilBooster other BoomBox other RIFLESPINE other Octopus other Pcexter other Empire tool Rclone tool
Metadata
MITRE ID: T1567.002
STIX ID: attack-pattern--bf1b6176-597c-...
Piattaforme: ESXi, Linux, macOS, Windows
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00