Forensia CTI Core

About

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Platforms: ESXi, Linux, macOS, Office Suite, SaaS, WindowsMITRE ATT&CK ↗

Used by actors

4 known groups

G0007 APT28 G0059 Magic Hound G1043 BlackByte G1052 Contagious Interview

Software

7 malware/tools implement this

ngrokDropBookAppleSeedSampleCheck5000OilCheckExbyteInvisibleFerret

Corpus indicators tagged with this technique

310 indicators in the corpus carry T1567.

Indicator	Type	Family	Sev	Src
cve-2025-1055	cve	ransomware	85	3
cve-2023-52271	cve	ransomware	85	3
cve-2025-61155	cve	ransomware	85	3
60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6	hash	ransomware	80	1
442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865	hash	—	80	1
589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880	hash	ransomware	80	1
bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc	hash	ransomware	80	1
1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11	hash	ransomware	80	1
8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4	hash	ransomware	80	1
97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2	hash	ransomware	80	1
f4d4b8cac004bb63834c6df436721babd9464c09787c80b268d839e0aada9f87	hash	—	80	1
1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449	hash	ransomware	80	1
449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e	hash	supply_chain	80	1
4a1a6ed11fd50b621659d7976899d050ba2e15d3	hash	—	80	1
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f	hash	ransomware	80	1
5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241	hash	ransomware	80	1
03dd0efa84d145d7d4ed8e240267e5c5	hash	ransomware	80	1
686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4	sha256	ransomware	80	1
7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245	hash	ransomware	80	1
6f9fbe29f8cc2788e2bc9d631e0eea2a8e9837076837b55838005a0e654f0a9e	hash	ransomware	80	3
90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c	hash	ransomware	80	1
f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347	hash	ransomware	80	1
24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7	hash	ransomware	80	1
4eebc38297a307d18784d6f9ebc8aa6e6f69860be970cc70d9e544deb1ff6ce0	hash	—	80	1
74bb6ad7e1310f30a3e24fd3cbbffa2c0c41c64e89e5d0dd1d6900e96b914183	hash	—	80	1
6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141	hash	ransomware	80	1
16bad42a397db2e075e09b5b9dd53aaa67b495a4	hash	ransomware	80	1
31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502	hash	ransomware	80	1
dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da	hash	ransomware	80	1

Showing the top 30 by severity of 310.