[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1041":3},{"item":4,"lessons":18,"controls":64,"related":93},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1041","T1041","Exfiltration Over C2 Channel",11,"MITRE","**What attackers do.** Attackers send stolen data out through the same command and control channel they already use to control compromised systems, so no new connection is needed. This serves the Exfiltration tactic.\n\n**How to defend.** Limit and monitor outbound traffic, send it through proxies and apply data loss prevention where practical. Detecting and cutting the command and control channel early prevents this as well. Set baselines for normal outbound data volumes per host.\n\n**Signs to look for.** Look for hosts sending much more data out than they receive, beacon traffic that suddenly grows, and large uploads to rare destinations. A common gap is watching only for exfiltration to well-known file sharing sites while ignoring volume changes on existing channels.","Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1041\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60],{"slug":21,"title":22,"published_at":23},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":25,"title":26,"published_at":27},"killsec-ransomware-takedown-exposes-110tb-of-stolen-victim-data","KillSec Ransomware Takedown Exposes 110TB of Stolen Victim Data","2026-10-01T16:21:40.406+00:00",{"slug":29,"title":30,"published_at":31},"insider-threat-active-duty-soldier-sentenced-for-multi-company-data-breach-spree","Insider Threat: Active-Duty Soldier Sentenced for Multi-Company Data Breach Spree","2026-09-25T22:20:49.355+00:00",{"slug":33,"title":34,"published_at":35},"china-linked-famoussparrow-targets-latin-american-governments-with-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with SparroWocky Backdoor","2026-09-22T00:20:41.743+00:00",{"slug":37,"title":38,"published_at":39},"macsync-stealer-uses-rotating-domains-to-evade-detection-on-macos","MacSync Stealer Uses Rotating Domains to Evade Detection on macOS","2026-08-18T20:21:33.916+00:00",{"slug":41,"title":42,"published_at":43},"ai-powered-infostealer-prioritizes-high-value-targets-using-behavioral-profiling","AI-Powered Infostealer Prioritizes High-Value Targets Using Behavioral Profiling","2026-07-24T13:20:19.98+00:00",{"slug":45,"title":46,"published_at":47},"goserpent-backdoor-targets-government-entities-with-stealthy-multi-stage-attacks","GoSerpent Backdoor Targets Government Entities with Stealthy Multi-Stage Attacks","2026-07-16T14:23:08.162+00:00",{"slug":49,"title":50,"published_at":51},"crashstealer-malware-masquerades-as-apple-crash-reporting-tool","CrashStealer Malware Masquerades as Apple Crash Reporting Tool","2026-07-13T20:20:57.194+00:00",{"slug":53,"title":54,"published_at":55},"social-engineering-weak-help-desk-controls-led-to-8m-ransomware-demand","Social Engineering + Weak Help Desk Controls Led to $8M Ransomware Demand","2026-07-07T14:20:40.065+00:00",{"slug":57,"title":58,"published_at":59},"mustang-panda-hides-c2-traffic-inside-zoho-workdrive-to-target-indian-government","Mustang Panda Hides C2 Traffic Inside Zoho WorkDrive to Target Indian Government","2026-06-29T18:20:50.569+00:00",{"slug":61,"title":62,"published_at":63},"amos-stealer-harvests-macos-credentials-via-social-engineering","Amos Stealer Harvests macOS Credentials via Social Engineering","2026-06-16T18:21:25.266+00:00",[65,70,75,80,85,89],{"slug":66,"name":67,"problem":68,"stories":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",9,{"slug":71,"name":72,"problem":73,"stories":74},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",4,{"slug":76,"name":77,"problem":78,"stories":79},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",3,{"slug":81,"name":82,"problem":83,"stories":84},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":86,"name":87,"problem":88,"stories":84},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":90,"name":91,"problem":92,"stories":84},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,100,105,110,115,119,124,128],{"family":95,"item":96,"code":97,"title":98,"together":99},"cis","13","Control 13","Network Monitoring and Defense",8,{"family":101,"item":102,"code":103,"title":104,"together":99},"gdpr","32","Article 32","Security of processing",{"family":95,"item":106,"code":107,"title":108,"together":109},"3","Control 3","Data Protection",5,{"family":111,"item":112,"code":113,"title":114,"together":109},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":95,"item":116,"code":117,"title":118,"together":109},"10","Control 10","Malware Defenses",{"family":120,"item":121,"code":122,"title":123,"together":109},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":111,"item":125,"code":126,"title":127,"together":74},"au-12","AU-12","Audit Record Generation",{"family":95,"item":129,"code":130,"title":131,"together":74},"6","Control 6","Access Control Management"]