MEGA Cloud Service
MEGA is a cloud storage and file hosting service. Qilin ransomware affiliates exfiltrated data to MEGA before deploying ransomware in attacks exploiting…
Tag: Data Exfiltration
HollowGraph Malware Uses Microsoft 365 Calendar Events Dated 2050 for C2 and Data Exfiltration
Group-IB has discovered a new espionage implant named HollowGraph that hijacks Microsoft 365 calendars for command-and-control (C2) and data exfiltration. The malware,…
FileZilla
FileZilla is a free FTP solution. Qilin ransomware affiliates used FileZilla for data exfiltration during post-exploitation activities after exploiting CVE-2026-0257.
s5cmd: Bulk File Operations Tool
s5cmd is a legitimate command-line tool used for bulk file operations, often with cloud storage. In the attack, it was deployed to…
Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
Cybersecurity researchers at Huntress have identified an intrusion where an unknown threat actor used a suspected AI-generated PowerShell script to enumerate Active…
GraphSpy: Post-Exploitation Tool for Microsoft 365 and Entra
GraphSpy is a tool used for post-exploitation of Microsoft 365 and Entra environments, often integrated into PhaaS platforms like DEBULL. It enables…
Iran-Linked Hackers Deploy New Cavern C2 Framework in Targeted Attacks on Israeli Organizations
Iranian state-sponsored hackers affiliated with the Ministry of Intelligence and Security (MOIS) have been using a previously undocumented modular command-and-control (C2) framework…
TrojPix Attack: New Covert Channel Leaks Data from Air-Gapped Systems via Video Cable Emissions
Researchers at Shandong University have unveiled a novel data exfiltration technique named TrojPix, capable of leaking sensitive information from air-gapped systems by…
TrojPix: Covert Channel for Air-Gapped Data Exfiltration
TrojPix is a malware technique developed by researchers at Shandong University that exfiltrates data from air-gapped systems by modulating video cable emissions.…
OmniStealer: Information Stealer in PolinRider Campaign
An information stealer delivered alongside DEV#POPPER RAT as a second-stage payload in the PolinRider campaign. Used to exfiltrate sensitive data from compromised…