Data Collection and Exfiltration

Data collection and exfiltration can be performed by threat actors either in the intermediate stages or in the final stages of an attack. In the first case, adversaries may exfiltrate and analyze intermediate information that can help them better understand the organization’s infrastructure, gain access to credentials, or check target documents for relevance. In the second case, however, exfiltration may be a precursor to impact, as in the case of ransomware operators, or even part of it, as in espionage.

Regardless of the stage at which data exfiltration takes place, the techniques used by threat actors will be similar. So, what will be the difference? First, the data in which threat actors are interested and the volume of data will differ. Depending on the motivation and goals of threat actors, as well as the current stage of the attack, the data being exfiltrated can be single files or entire virtual server disks. Naturally, in the case...