Technique
technique:data_exfiltration
Also: data copying, data extraction, data theft, exfiltrating private information, exfiltration, exporting data
Removal of collected data from a victim environment, including through Dropbox or Google Drive services.
Transfer of scraped payment-card data from compromised systems to attacker-controlled central systems.
“it pushes that data over the wire to the central repository system”
Copying files from the exposed school folder into cloud storage and removing them from the local download trail.
“I would copy and paste the files into there”
“there was no – I guess you could say, paper trail of me actually downloading the files”
Taking patient records from the medical provider’s database.
“accessed the database and took a ton of patient records”
Downloading compressed sensitive files, including customer, staff, gambler, social security, and driver license information.
“sensitive files were being compressed and downloaded”
“Social security numbers were stolen, drivers license details were stolen.”
Collection and removal of emails, photos, call records, texts, locations, and other target data.
“They vacuumed up photos, e-mails, call records, conversations, texts, locations”
“all of this data exfiltration David was doing on the targets”
Copying stolen database records to attacker-controlled servers and exporting data over an extended period.
“quietly accessing databases and exporting data to their own servers”
Removal of collected data from a victim environment, including through Dropbox or Google Drive services.
“you have to exfiltrate the data outside of organization”
“the exfiltration method is using a Dropbox client”
The unauthorised transfer of company documents, research, intellectual property, or other sensitive information outside the organisation.
“Sending proprietary information that your company doesn’t want to be public is a form of a data breach.”
“actively exfiltrating private information”
Automated transfer of financial transaction and trade data to an external server.
“it was sending out these files at 1:00 in the morning”
Unauthorized extraction of database records inferred from the attacker’s blind SQL-injection queries.
“So, they did exfiltrate our data”
“this is how you can know for sure that it’s true”
Unauthorized copying or removal of data from an environment, including the cloning of private repositories.
“he’s cloned and downloaded over 100 repositories”
“data has been exfiltrated”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tiny POS | Explicit | 15 |
| incoming | USES | Finn | Derived | 17 |
| incoming | INVOLVES | Finn school hacking incident | Explicit | 17 |
| incoming | INVOLVES | medical-provider patient-record extortion | Explicit | 25 |
| incoming | INVOLVES | Las Vegas Sands cyber-attack | Explicit | 37 |
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | INVOLVES | JPMorgan Chase breach | Explicit | 76 |
| incoming | USES | Spark | Explicit | 89 |
| incoming | USES | SharpStage | Explicit | 89 |
| incoming | USES | DropBook | Derived | 89 |
| incoming | INVOLVES | Defcon financial-data exfiltration | Explicit | 157 |
| incoming | LEADS_TO | Blind SQL injection | Derived | 165 |
| incoming | USES | Nickolas Sharp | Explicit | 178 |
| incoming | INVOLVES | CWT ransomware attack | Explicit | 178 |
| incoming | INVOLVES | Ubiquiti breach | Explicit | 178 |
Tiny POS USES Data exfiltration
The malware pushed scraped data over the network to central repository or clearing-house systems.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“it pushes that data over the wire to the central repository system”
“Malware was directly writing over the wire right to these systems”
Finn USES Data exfiltration
Finn copied files from the principal’s exposed folder into Google Drive, describing this as a way to avoid a download paper trail.
Derived Confidence 96% · Finn EP 17 Details
“I would copy and paste the files into there, that way there was no – I guess you could say, paper trail of me actually downloading the files.”
Finn school hacking incident INVOLVES Data exfiltration
The incident involved copying and publicly posting student, employee, parent, and other private information.
Explicit Confidence 99% · Jack Rhysider EP 17 Details
“He then posted the principal’s Social Security Number and other private info.”
“I posted the list of everybody’s e-mail and then everybody’s password.”
medical-provider patient-record extortion INVOLVES Data exfiltration
The attacker accessed the database and took patient records.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“accessed the database and took a ton of patient records”
Las Vegas Sands cyber-attack INVOLVES Data exfiltration
During the attack, sensitive customer, guest, staff, and gambler data was compressed and downloaded.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“sensitive files were being compressed and downloaded”
“Social security numbers were stolen, drivers license details were stolen”
Project Raven USES Data exfiltration
Project Raven collected communications and other data from targets rather than conducting destructive operations.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“This was just collecting communications.”
JPMorgan Chase breach INVOLVES Data exfiltration
The attackers quietly accessed databases and exported data to their own servers for months.
Explicit Confidence 99% · Jack Rhysider EP 76 Details
“For months, these hackers had been creeping around, quietly accessing databases and exporting data to their own servers”
Spark USES Data exfiltration
Spark can be used to steal and harvest information from a victim endpoint.
Explicit Confidence 96% · Assaf Dahan EP 89 Details
“They can run different commands, they can use it to steal information”
“basically harvest any information.”
SharpStage USES Data exfiltration
SharpStage uses Dropbox as its method for exfiltrating data.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“the exfiltration method is using a Dropbox client”
DropBook USES Data exfiltration
DropBook is described as exfiltrating victim data through Dropbox.
Derived Confidence 95% · Jack Rhysider EP 89 Details
“it exfiltrates that data through Dropbox.”
Defcon financial-data exfiltration INVOLVES Data exfiltration
The incident involved nightly transmission of a zip file containing the organization’s financial transactions and trades.
Explicit Confidence 99% · Grifter EP 157 Details
“that is every financial transaction and trade that we’ve made in the last twenty-four hours”
Blind SQL injection LEADS_TO Data exfiltration
The episode explains that blind SQL injection enabled the attacker to infer and exfiltrate the database contents.
Derived Confidence 94% · Tanya Janca EP 165 Details
“So, they did exfiltrate our data, and that is what happened”
“you can know for sure that it’s true”
Nickolas Sharp USES Data exfiltration
Nick downloaded more than 100 repositories containing gigabytes of confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he’s cloned and downloaded over 100 repositories”
“That’s gigabytes of confidential company data.”
CWT ransomware attack INVOLVES Data exfiltration
The attackers stole two terabytes of data from CWT.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“The hackers stole two terabytes of data.”
Ubiquiti breach INVOLVES Data exfiltration
The Ubiquiti breach involved exfiltration of private repositories and other confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“data has been exfiltrated”
“he’s cloned and downloaded over 100 repositories”