T1041: Exfiltration Over C2 Channel
AI Answer
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications. (Source: MITRE ATT&CK T1041)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1041 |
| Name | Exfiltration Over C2 Channel |
| Tactic | Exfiltration (exfiltration) |
| Platforms | ESXi, Linux, macOS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Exfiltration Over C2 Channel (T1041) is one of the highest-connectivity ATT&CK techniques: 203 MITRE STIX relationships reference this technique; 27 threat groups observed using it; 166 software families associated; 10 campaigns associated; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1041). Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Detection
DET0348 Detection Strategy for Exfiltration Over C2 Channel AN0988 Identifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access. AN0989 Monitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads. AN0990 Detects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios. AN0991 Detects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1041).
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- TrickBot
- BLINDINGCAN
- Pikabot
- Spark
- Bumblebee
- BRICKSTORM
- Amadey
- Proxysvc
- Torisma
- Stuxnet
- RotaJakiro
- KOPILUWAK
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- BlackByte
- GALLIUM
- APT3
- Kimsuky
- APT32
- MuddyWater
- Gamaredon Group
- Sandworm Team
- CURIUM
- Mustang Panda
- ZIRCONIUM
- Scattered Spider
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- SharePoint ToolShell Exploitation
- Frankenstein
- RedPenguin
- Operation Honeybee
- HomeLand Justice
- ArcaneDoor
- Operation Wocao
- Leviathan Australian Intrusions
- C0017
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1041 Exfiltration Over C2 Channel. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1041 Exfiltration Over C2 Channel?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.