Academy
TermTechnique

Data exfiltration

Transferring collected data to a location controlled by the attacker.

Flow

  1. 1Data prepared
  2. 2Channel chosen
  3. 3Transferred
Related families
Masad Stealer, Stealerium
MITRE ATT&CK
TA0010 · Exfiltration
Sources
8 sources
01

Overview

MITRE ATT&CK treats exfiltration as a separate tactic: the attacker uses an existing connection, a web service or a separate channel to get collected data out unnoticed. MITRE ATT&CK

For infostealers, exfiltration is a single small archive; in corporate data theft, large transfers spread over days are seen. MITRE ATT&CK

02

How it works

  1. 1

    Data prepared

    Collected files are compressed and sometimes encrypted. MITRE ATT&CK

  2. 2

    Channel chosen

    Command and control server, Telegram bot, email (SMTP) or cloud storage. MITRE ATT&CK

  3. 3

    Transferred

    Data is sent with requests that look like ordinary traffic. MITRE ATT&CK

03

Real-world examples

Stealerium: by email

Stealerium profile

Proofpoint reported that SMTP was the most common exfiltration method in Stealerium-based malware. Proofpoint

Snowflake: to cloud storage

Mandiant found that UNC5537 stored the stolen data on virtual servers and in the MEGA cloud storage service. Google Cloud (Mandiant)

04

How to detect it

  • Traffic from servers to Telegram, cloud storage or unknown SMTP servers. MITRE ATT&CK
  • A one-off upload from a process that is larger than its normal use would suggest. MITRE ATT&CK
05

What to do

  • Restrict network egress with an allowlist; disable unused cloud and messaging services. MITRE ATT&CK
06

MITRE ATT&CK

TA0010ExfiltrationT1041Exfiltration Over C2 ChannelT1567Exfiltration Over Web ServiceT1560Archive Collected Data
07

Related families and terms

Families

Masad StealerInactiveStealeriumDeclining

Report

Infostealer Threat Report — October 2026

Terms

Command and control serverInfostealerLeak impact analysis
08

Sources

  1. 1Exfiltration (TA0010) · MITRE ATT&CK
  2. 2Exfiltration Over C2 Channel (T1041) · MITRE ATT&CK
  3. 3Exfiltration Over Web Service (T1567) · MITRE ATT&CK
  4. 4Archive Collected Data (T1560) · MITRE ATT&CK
  5. 5Masad Stealer: exfiltrating using Telegram · Juniper, 2019
  6. 6Not safe for work: Stealerium and Phantom infostealers · Proofpoint, 2025
  7. 7UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  8. 8Filter Network Traffic (M1037) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans