T1020: T1020
Essential information
- MITRE technique ID
T1020- Confidence
- 100/100
- Revoked
- No
- Published
- 31/05/2017 23:30
- Modified
- 27/03/2026 01:10
- Author / Source
- The MITRE Corporation
Aliases
Automated Exfiltration
Platforms
windows macos linux Network Devices
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | exfiltration |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (50)
-
The MITRE Corporation Confidence 100
[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Mysterious Elephant relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SAMBA SPIDER relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Sandworm relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Sparkling Pisces relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
UNC6040 relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Vice Society relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Void Blizzard relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation:…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (73)
-
PureHVNC usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Kiron usesFamily
-
GODZILLA usesFamily
-
LameHug usesFamily
-
IcedID usesFamily
-
TrojanSpy usesFamily
-
COBEACON usesFamily
-
Lumma Stealer usesThe MITRE Corporation Confidence 100
[Lumma Stealer](https://attack.mitre.org/software/S1213) is an information stealer malware family in use since at least 2022. [Lumma Stealer](https://attack.mitre.org/software/S1213) is a Malware as a Service (MaaS) where captured data has been…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Hannotog uses
-
sysProcUpdate usesFamily
-
BlackCat uses
-
Rhadamanthys usesFamily
Reports (41)
-
AlienVault Confidence 100 3 CVEs 21 MITREs 2 Malwares 8 IOCs 2 Observables
-
AlienVault Confidence 100 13 MITREs 3 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 20 MITREs 7 IOCs 7 Observables 1 APT
-
2 CVEs 19 MITREs 6 Malwares 4 Observables 1 APT
-
AlienVault Confidence 100 24 MITREs 2 Malwares 13 IOCs 13 Observables
-
AlienVault Confidence 100 20 MITREs 1 Malware 13 IOCs 13 Observables
-
AlienVault Confidence 100 20 MITREs 3 Malwares 10 IOCs 10 Observables
-
20 MITREs 3 Malwares 7 Observables 1 APT
-
14 MITREs 1 Malware 5 Observables 1 APT
-
1 CVE 10 MITREs 1 Malware 4 Observables
-
10 CVEs 16 MITREs 2 Malwares 9 Observables
-
20 MITREs 2 Malwares 21 Observables 1 APT
Vulnerabilities (CVE) (37)
RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary …
- Attack vector
- Network
- Published
- 12/08/2025
- Modified
- 27/05/2026
Attack patterns (MITRE) (1)
-
Traffic Duplication subtechnique-of
Tool (1)
-
ShimRatReporter usesThe MITRE Corporation Confidence 100
[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as…
Campaign (1)
-
ArcaneDoor uses