Exfiltration Over Web Service: Exfiltration to Cloud Storage
- ID
- T1567.002
- Tactics
- TA0010 Exfiltration
- Sub-technique of
- T1567 Exfiltration Over Web Service
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- File Access, Network Connection Creation, Process Creation, Command Execution, Network Traffic Flow, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.
Detection
- DET0570 Detection Strategy for Exfiltration to Cloud Storage
Data components: File Access, Network Connection Creation, Process Creation, Command Execution, Network Traffic Flow, Network Traffic Content
Mitigations (1)
- M1021 Restrict Web-Based Content
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.
Groups (25)
- G0010 Turla
- G0027 Threat Group-3390
- G0046 FIN7
- G0065 Leviathan
- G0069 MuddyWater
- G0094 Kimsuky
- G0102 Wizard Spider
- G0114 Chimera
- G0119 Indrik Spider
- G0125 HAFNIUM
- G0128 ZIRCONIUM
- G0129 Mustang Panda
- G0142 Confucius
- G1001 HEXANE
- G1003 Ember Bear
- G1005 POLONIUM
- G1006 Earth Lusca
- G1014 LuminousMoth
- G1015 Scattered Spider
- G1021 Cinnamon Tempest
- G1022 ToddyCat
- G1024 Akira
- G1051 Medusa Group
- G1052 Contagious Interview
- G1053 Storm-0501