TACTIC: EXFILTRATION
Automated Exfiltration (T1020): Real Cases
MITRE Definition ↗ Adversaries use automated scripts to periodically transmit collected data out of the network.
Key Facts
Technique ID
T1020
Exfiltration
Mapped Cases
1
Primary sources
Related Laws
3
Criminal statutes
- ATT&CK Technique Identifier: T1020.
- Tactical Phase: Exfiltration.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
sentenced 2018-03-27
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
Primary Source Evidence Excerpt: Plea Agreement ¶ 9, Page 6
"Automated batch scripts compressed and transmitted stolen point-of-sale logs every night at midnight to C2 drops."
U.S. District Court for the Western District of Washington · 2:18-cr-00067
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(2)
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
18 U.S.C. § 1030(b)
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.
18 U.S.C. § 1962(d)
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.