Exfiltration Over C2 Channel (T1041): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1041.
- Tactical Phase: Exfiltration.
- Substantiated in 14 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (14)
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Before encrypting hosts, affiliates launched custom StealBit exfiltration executables, parsing local drives for office documents and intellectual property and parallel-uploading gigabytes of data to offshore servers.
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
"Stolen medical claims and personally identifiable information were uploaded to adversary-controlled cloud servers prior to payload delivery."
Colonial Pipeline DarkSide Ransomware Attack
DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.
"Adversaries exfiltrated approximately 100 gigabytes of internal corporate documents to cloud servers before deploying encryption routines."
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
"Defendants harvested payment card track data from Point-of-Sale (POS) memory and exfiltrated records back to private C2 servers."
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
Lazarus operatives breached the Bangladesh Central Bank network, harvesting SWIFT alliance terminal credentials to issue 35 fraudulent wire transfer orders totaling $951 million, successfully stealing $81 million.
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
"Malicious memory-scraping software extracted Track 2 payment card data from process memory and exfiltrated packets to Russian server drops."
U.S. v. Sun Kailiang et al. (PLA Unit 61398 / APT1)
Historic first-ever criminal indictment against state military actors: five Chinese military officers in People's Liberation Army Unit 61398 charged with cyber espionage against Westinghouse, U.S. Steel, Alcoa, and the United Steelworkers union.
"Exfiltrated thousands of sensitive proprietary technical specifications including AP1000 nuclear reactor piping diagrams."
U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)
Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.
"Installed packet sniffer utilities inside Heartland's payment processing network that captured unencrypted credit card magnetic stripe data during authorization."
U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)
Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.
"Exfiltrated contact records of 83 million individual and small business accounts, the largest single corporate breach of a U.S. bank at the time."
Target Corporation Point-of-Sale Data Breach (Fazio Mechanical Ingress)
Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.
"Track 1 and Track 2 payment card data harvested from memory was temporarily staged on internal compromised servers before being batched and exfiltrated to compromised FTP servers in Russia and Brazil."
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
"Adversaries executed native SQL commands in Snowflake command-line clients (snowsql) to stage and export customer database tables."
Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)
Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.
"Adversaries exfiltrated emails and attachments belonging to Microsoft senior executive leadership and cybersecurity personnel over encrypted HTTPS channels."
Hewlett Packard Enterprise M365 Email Breach (Midnight Blizzard)
State-sponsored cyber espionage campaign conducted by Russian Foreign Intelligence Service (SVR) unit Midnight Blizzard (APT29) infiltrating Hewlett Packard Enterprise cloud-hosted Microsoft Office 365 environment, accessing executive leadership and cybersecurity correspondence, disclosed under SEC Form 8-K filings.
Messages containing threat intelligence research, internal incident notes, and executive communications were exfiltrated over HTTPS channels.
Neiman Marcus 1.1 Million Payment Card In-Memory Scraping
Sophisticated memory-scraping malware intrusion into point-of-sale systems across 77 Neiman Marcus luxury department stores, capturing payment card Track 2 data in memory over a four-month stealth campaign, resolved through a multi-state Attorney General consent decree.
Scraped card numbers were aggregated into encrypted staging files and exfiltrated to adversary-controlled servers over external ports.
Commonly Charged Criminal Statutes
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.