T1567.002: T1567.002

Search IOCs, vulnerabilities, APT…

216.73.217.24

← Back to attack patterns

View on MITRE ATT&CK The MITRE Corporation · Published 09/03/2020 16:04 · Modified 27/03/2026 01:11

Essential information

MITRE technique ID: T1567.002
Confidence: 100/100
Revoked: No
Published: 09/03/2020 16:04
Modified: 27/03/2026 01:11
Author / Source: The MITRE Corporation

Aliases

Exfiltration to Cloud Storage

Platforms

windows macos linux ESXi

Description

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Kill chain phases

Kill chain	Phase
mitre-attack	exfiltration

Marking (TLP)

External references

mitre-attack (T1567.002)

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.

Intrusion sets (APT) (55)

Mallox uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
PhantomRaven uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Braodo uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT-C-53 (Gamaredon) related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT31 related Violet TyphoonZIRCONIUM

The MITRE Corporation Confidence 100

[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders…

First seen 01/01/1970 · Last seen 16/11/5138 ·
BlackSuit related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
CL-STA-1020 related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Cinnamon Tempest related DEV-0401Emperor Dragonfly

The MITRE Corporation Confidence 100

[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon…

First seen 01/01/1970 · Last seen 16/11/5138 ·
CloudWizard related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Contagious Interview related Gwisin GangTAG-121

The MITRE Corporation Confidence 100

[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials.…

First seen 01/01/1970 · Last seen 16/11/5138 ·
DPRK-aligned operators related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Domain related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 5

25–36 of 55

ODAgent uses

Family The MITRE Corporation Confidence 100

[ODAgent](https://attack.mitre.org/software/S1170) is a C#/.NET downloader that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2022 including against target organizations in Israel to download and execute payloads and to…

First seen 01/01/1970 · Last seen 16/11/5138 ·
COBEACON uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Atomic macOS Stealer uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
StageComp uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
XMRig uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SectopRAT uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Sliver uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SSLORDoor uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
POISONPLUG.SHADOW uses

The MITRE Corporation Confidence 100

[ShadowPad](https://attack.mitre.org/software/S0596) is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Crutch uses

Family The MITRE Corporation Confidence 100

[Crutch](https://attack.mitre.org/software/S0538) is a backdoor designed for document theft that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2015.(Citation: ESET Crutch December 2020)

First seen 01/01/1970 · Last seen 16/11/5138 ·
MioLab uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Filemanager uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 6

1–12 of 70

Malicious Artifacts Found in Official KICS Docker Repository … related

AlienVault Confidence 100 19 MITREs 2 Malwares 14 IOCs 14 Observables 1 APT
Untangling a Linux Incident With an OpenAI Twist … related

3 CVEs 19 MITREs 7 Malwares 3 Observables
Void Dokkaebi Uses Fake Job Interview Lure to … related

AlienVault Confidence 100 20 MITREs 5 Malwares 10 IOCs 10 Observables 1 APT
Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets related

19 MITREs 1 Malware 2 Observables 1 APT
Operation CamelClone: Multi-Region Espionage Campaign Targets Government and … related

11 MITREs 1 Malware 29 Observables
Nefilim Ransomware related

13 MITREs 14 Observables 1 APT
Inside a Multi-Stage Windows Malware Campaign related

26 MITREs 11 Observables
NANOREMOTE, cousin of FINALDRAFT related

5 MITREs 3 Malwares 5 Observables
React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics related

2 CVEs 18 MITREs 2 Malwares 38 Observables
macOS Malware Deploys in Fake Job Scams related

14 MITREs 1 Malware 21 Observables 1 APT
Inside Salt Typhoon: China's State-Corporate Advanced Persistent Threat related

16 MITREs 1 APT
TOATH Campaign Exploits End-of-Support Software to Target Traditional … related

19 MITREs 6 Malwares 23 Observables 1 APT

← Previous

Page / 5

25–36 of 50

Vulnerabilities (CVE) (30)

CVE-2024-21887 KEV targets

9.1 Critical

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web …

Attack vector: Network
Published: 10/01/2024
Modified: 27/05/2026

CVE-2023-4966 KEV targets

9.4 Critical

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway …

Attack vector: Network
Published: 18/10/2023
Modified: 21/12/2025

CVE-2024-40766 KEV targets

9.8 Critical

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in …

Attack vector: Network
Published: 09/09/2024
Modified: 21/12/2025

Analyzed

CVE-2024-23897 KEV targets

9.8 Critical

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead …

Attack vector: Network
Published: 19/08/2024
Modified: 21/12/2025

CVE-2021-44228 KEV targets

10.0 Critical

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Attack vector: Network
Published: 10/12/2021
Modified: 27/05/2026

CVE-2026-20182 KEV targets

10.0 Critical

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was …

Attack vector: NETWORK
Complexity: LOW
Published: 14/05/2026
Modified: 18/06/2026

CWE-287 Analyzed

← Previous

Page / 3

25–30 of 30

T1567 subtechnique-of

Exfiltration Over Web Service MITRE

Campaign (2)

C0015 uses
APT41 DUST uses

Tool (1)

Empire uses

The MITRE Corporation Confidence 100

[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents…

Contact About Legal notice Privacy policy Terms of use