T1567.002: T1567.002

Search IOCs, vulnerabilities, APT…

216.73.217.172

← Back to attack patterns

View on MITRE ATT&CK The MITRE Corporation · Published 09/03/2020 16:04 · Modified 27/03/2026 01:11

Essential information

MITRE technique ID: T1567.002
Confidence: 100/100
Revoked: No
Published: 09/03/2020 16:04
Modified: 27/03/2026 01:11
Author / Source: The MITRE Corporation

Aliases

Exfiltration to Cloud Storage

Platforms

windows macos linux ESXi

Description

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Kill chain phases

Kill chain	Phase
mitre-attack	exfiltration

Marking (TLP)

External references

mitre-attack (T1567.002)

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.

Intrusion sets (APT) (55)

Mallox uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
PhantomRaven uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Braodo uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT-C-53 (Gamaredon) related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT31 related Violet TyphoonZIRCONIUM

The MITRE Corporation Confidence 100

[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders…

First seen 01/01/1970 · Last seen 16/11/5138 ·
BlackSuit related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
CL-STA-1020 related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Cinnamon Tempest related DEV-0401Emperor Dragonfly

The MITRE Corporation Confidence 100

[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon…

First seen 01/01/1970 · Last seen 16/11/5138 ·
CloudWizard related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Contagious Interview related Gwisin GangTAG-121

The MITRE Corporation Confidence 100

[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
DPRK-aligned operators related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Domain related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 5

25–36 of 55

ODAgent uses

Family The MITRE Corporation Confidence 100

[ODAgent](https://attack.mitre.org/software/S1170) is a C#/.NET downloader that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2022 including against target organizations in Israel to download and execute payloads and to…

First seen 01/01/1970 · Last seen 16/11/5138 ·
COBEACON uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Atomic macOS Stealer uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
StageComp uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
XMRig uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SectopRAT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Sliver uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SSLORDoor uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
POISONPLUG.SHADOW uses

The MITRE Corporation Confidence 100

[ShadowPad](https://attack.mitre.org/software/S0596) is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Crutch uses

Family The MITRE Corporation Confidence 100

[Crutch](https://attack.mitre.org/software/S0538) is a backdoor designed for document theft that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2015.(Citation: ESET Crutch December 2020)

First seen 01/01/1970 · Last seen 16/11/5138 ·
MioLab uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Filemanager uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 6

1–12 of 70

Malicious Artifacts Found in Official KICS Docker Repository … related

AlienVault Confidence 100 19 MITREs 2 Malwares 14 IOCs 14 Observables 1 APT
Untangling a Linux Incident With an OpenAI Twist … related

3 CVEs 19 MITREs 7 Malwares 3 Observables
Void Dokkaebi Uses Fake Job Interview Lure to … related

AlienVault Confidence 100 20 MITREs 5 Malwares 10 IOCs 10 Observables 1 APT
Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets related

19 MITREs 1 Malware 2 Observables 1 APT
Operation CamelClone: Multi-Region Espionage Campaign Targets Government and … related

11 MITREs 1 Malware 29 Observables
Nefilim Ransomware related

13 MITREs 14 Observables 1 APT
Inside a Multi-Stage Windows Malware Campaign related

26 MITREs 11 Observables
NANOREMOTE, cousin of FINALDRAFT related

5 MITREs 3 Malwares 5 Observables
React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics related

2 CVEs 18 MITREs 2 Malwares 38 Observables
macOS Malware Deploys in Fake Job Scams related

14 MITREs 1 Malware 21 Observables 1 APT
Inside Salt Typhoon: China's State-Corporate Advanced Persistent Threat related

16 MITREs 1 APT
TOATH Campaign Exploits End-of-Support Software to Target Traditional … related

19 MITREs 6 Malwares 23 Observables 1 APT

← Previous

Page / 5

25–36 of 50

Vulnerabilities (CVE) (30)

CVE-2023-22524 targets

9.8 Critical

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets …

Attack vector: NETWORK
Published: 06/12/2023
Modified: 21/12/2025

CVE-2023-22518 KEV targets

9.8 Critical

Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an …

Attack vector: Network
Published: 07/11/2023
Modified: 21/12/2025

CVE-2026-31431 KEV targets

7.8 High

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 …

Attack vector: LOCAL
Complexity: LOW
EPSS: 0.0001 (P0.6%)
Published: 22/04/2026
Modified: 23/05/2026

CWE-669 Awaiting Analysis

CVE-2021-26855 KEV targets

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published: 03/11/2021
Modified: 20/12/2025

CVE-2023-22515 KEV targets

9.8 Critical

Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts …

Attack vector: Network
Published: 05/10/2023
Modified: 21/12/2025

CVE-2020-1472 KEV targets

5.5 Medium

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a …

Attack vector: Local
Published: 03/11/2021
Modified: 27/05/2026

CVE-2025-20333 KEV targets

9.9 Critical

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense …

Attack vector: Network
Published: 25/09/2025
Modified: 21/12/2025

Analyzed

CVE-2017-7921 KEV targets

9.8 Critical

Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain …

Attack vector: NETWORK
Complexity: LOW
EPSS: 0.9410 (P99.9%)
Published: 06/05/2017
Modified: 22/04/2026

CWE-287

CVE-2025-26399 KEV targets

9.8 Critical

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would …

Attack vector: Network
Published: 23/09/2025
Modified: 12/03/2026

Awaiting Analysis

CVE-2025-55182 KEV targets

10.0 Critical

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …

Attack vector: Network
Published: 05/12/2025
Modified: 29/05/2026

Analyzed

CVE-2023-22527 KEV targets

9.8 Critical

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.

Attack vector: Network
Published: 24/01/2024
Modified: 21/12/2025

CVE-2024-3577 targets

Published: 20/12/2025
Modified: 21/12/2025

← Previous

Page / 3

13–24 of 30

T1567 subtechnique-of

Exfiltration Over Web Service MITRE

Campaign (2)

C0015 uses
APT41 DUST uses

Tool (1)

Empire uses

The MITRE Corporation Confidence 100

[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents…

Contact About Legal notice Privacy policy Terms of use