MITRE ATT&CKtechnique

T1646 Exfiltration Over C2 Channel

Published 2022-04-01 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Exfiltration
Platforms
Android, iOS
Version
1.1
Created
2022-04-01

Description

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (31)

  • S9040 NGate software (malware)
  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • S1225 CherryBlos software (malware)
  • S1215 Binary Validator software (malware)
  • S1185 LightSpy software (malware)
  • C0033 C0033 campaign
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1093 FlyTrap software (malware)
  • S1083 Chameleon software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1067 FluBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • C0016 Operation Dust Storm campaign
  • S0551 GoldenEagle software (malware)
  • S0507 eSurv software (malware)
  • S0490 XLoader for iOS software (malware)
  • S0421 GolfSpy software (malware)
  • S0418 ViceLeaker software (malware)
  • S0424 Triada software (malware)
  • S0399 Pallas software (malware)
Show all 31 ›

References