Log in Request a demo

Attack technique

Exfiltration Over C2 Channel

Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system.

In short

Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system. The data is hidden inside what looks like normal control traffic, so no second route out of the network is needed. MITRE ATT&CK tracks it as T1041 under Exfiltration.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Exfiltration · Step 14 Of 15 In The Attack Chain

  1. MITRE IDT1041ATT&CK technique
  2. Detection4ways to spot itWatch for odd outbound traffic · Detection strategy MITRE lists
  3. Defences2ways to stop itUse data loss prevention

How it works

An attacker who controls a system usually keeps a command and control channel open, called C2 for short. Through it they send instructions to the system and receive replies.

With this technique, the stolen data travels back over that same channel. MITRE says the data is encoded into the normal communications channel and uses the same protocol as the C2 traffic.

This is simple for the attacker because no second route out of the network is needed. It also means the stolen data can blend in with traffic that is already there.

A real example

MITRE ATT&CK lists these procedure examples:

  • ADVSTORESHELL exfiltrates data over the same channel it uses for command and control.
  • Amadey has sent victim data to its command servers.
  • AppleSeed can exfiltrate files through its command and control channel.

How to detect

  1. Watch for odd outbound traffic

    Look for processes that rarely use the network but suddenly send a lot of data out, over HTTPS, DNS or custom ports, after reading files or data.

  2. Link file reads to new connections

    Look for a process that reads sensitive files and then quickly opens an unusual outbound connection or a bulk transfer, especially with encrypted content.

  3. Check destinations and virtual machines

    Look for unauthorized applications or scripts sending encrypted traffic to rare external destinations, and for virtual machines sending traffic to unknown places.

  4. Detection strategy MITRE lists

    DET0348, Detection Strategy for Exfiltration Over C2 Channel.

How to defend

  1. Use data loss prevention

    Data loss prevention can detect and block sensitive data that is sent over unencrypted protocols.

  2. Use network intrusion detection and prevention

    Signature-based network tools can flag traffic from known malware. Attackers are likely to change their C2 traffic over time, so signatures need regular updates and will not catch everything.

Questions

What is exfiltration over a C2 channel?

It is when an attacker sends stolen data back through the same command and control channel they use to control the infected system. MITRE says the data is encoded into that channel and uses the same protocol as the C2 traffic. It is tracked as T1041.

Why do attackers use the C2 channel to steal data?

It is simple, because no second route out of the network is needed. The stolen data can also blend in with traffic that is already there.

How can defenders detect data theft over C2?

Look for processes that rarely use the network but suddenly send a lot of data out over HTTPS, DNS or custom ports after reading files. Also link sensitive file reads to new outbound connections or bulk transfers.

How do you defend against exfiltration over C2?

Data loss prevention can detect and block sensitive data sent over unencrypted protocols. Signature-based network intrusion detection can flag known malware traffic, but attackers change their C2 traffic over time, so signatures need regular updates.

In our research

  1. Exposed PLCs: lessons from the 2026 US advisory October 2026
  2. Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  3. [Research Summary]: Mystic Stealer December 2023
  4. Echida Stealer Technical Analysis November 2023
  5. Most Common Attack Vectors & Ransomware Threat Relation October 2022
  6. [Research Summary]: Zebrocy Malware September 2022

Sources

  1. MITRE ATT&CK T1041: Exfiltration Over C2 Channel MITRE
  2. MITRE ATT&CK Exfiltration (TA0010) MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Gamaredon

Attributed by Ukraine's Security Service (SSU, 2021) to Russia's FSB, and described by MITRE ATT&CK as a suspected Russian group that has targeted Ukrainian organizations since at least 2013. It mostly gets in through emails with Office files or archives, and a Ukrainian court convicted two members in absentia on 8 October 2024.

Read more

Glossary term

Command and control (C2)

Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them.

Read more