Procedure examples

APT38 has collected data from a compromised host.

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.

APT3 will identify Microsoft Office documents on the victim's computer.

Kimsuky has collected Office, PDF, and HWP documents from its victims. Kimsuky has also harvested victim files through the use of the `RecentFiles()` function that collects paths of recently accessed files by parsing .lnk shortcuts from `%APPDATA%\Microsoft\Windows\Recent`.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Patchwork collected and exfiltrated files from the infected system.

APT41 has uploaded files and data from a compromised host.

Dragonfly has collected data from local victim systems.

menuPass has collected various files from the compromised computers.

HAFNIUM has collected data and files from a compromised machine.

FIN6 has collected and exfiltrated payment card data from compromised systems.

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

FIN7 has collected files and other sensitive information from a compromised network.

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.

Andariel has collected large numbers of files from compromised network systems for later extraction.

CURIUM has exfiltrated data from a compromised machine.

APT39 has used various tools to steal files from the compromised host.

APT37 has collected data from victims' local systems.

OilRig has used PowerShell to upload files from compromised systems.

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.

Ke3chang gathered information and files from local directories for exfiltration.

APT1 has collected files from a local victim.

Turla RPC backdoors can upload files from victim machines.

RedCurl has collected data from the local disk of compromised hosts.

Stealth Falcon malware gathers data from the local victim system.

APT29 has stolen data from compromised hosts.

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.

MirrorFace gathered data and files of interest from victim's systems.

BRONZE BUTLER has exfiltrated files stolen from local systems.

Axiom has collected data from a compromised network.

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.

ToddyCat has run scripts to collect documents from targeted hosts.

LuminousMoth has collected files and data from compromised machines.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

Fox Kitten has searched local system resources to access sensitive documents.

Lazarus Group has collected data and files from compromised networks.

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.

Wizard Spider has collected data from a compromised host prior to exfiltration.

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

VOID MANTICORE has collected cached data and files from within the victim environment.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.

TeamPCP has stolen source code from victim environments including Mistral AI.