Summary

Data collection and exfiltration are activities that can occur either during the development of an attack or as the main stage of an attack, depending primarily on the motivation of the threat actors.

If the goal of the attack is to encrypt data for financial gain, sensitive data exfiltration can have a strong impact on the victim and push the decision to pay the ransom. In classic attacks on the financial sector, exfiltration is necessary to gain a deep insight into the payment systems and processes taking place in the victim’s infrastructure. As for threat actors whose primary motivation is state or corporate espionage, exfiltration itself will be a critical step in achieving the goal.

In the process of data collection and exfiltration, adversaries may use special tools, system utilities, and programs installed on the hosts of compromised users, while exfiltration itself can be conducted through many different channels. Whatever tools and techniques threat actors...