Patchfirst
Patchfirst
T1041Exfiltration

Exfiltration Over C2 Channel

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

attack.mitre.org ↗
CVEs12
In 12
Reports0

Detections

5 Sigma rules tagged T1041
Exfiltration Over C2 ChannelT10415 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Exfiltration Over C2 Channel

12 CVEs, by priority. Each link shows its badge.
  1. CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports
    MITRE CTID mapping of the KEV entry · primary impact
    99.9%Top 0.03%
    88.8priority
  2. CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
    Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    99.7%Top 0.05%
    83.7priority
  3. CVE-2023-38831RARLAB WinRAR Code Execution Vulnerability
    RARLAB · WinRARKEVRansomwarePublic exploitHigh · 7.8T1204User ExecutionT1053Scheduled Task/Job+5 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.8%Top 0.04%
    82.3priority
  4. CVE-2024-4577PHP-CGI OS Command Injection Vulnerability
    PHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.02%
    79.9priority
  5. CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
    Fortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    30.9%Top 1.7%
    79.5priority
  6. CVE-2024-55550Mitel MiCollab Path Traversal Vulnerability
    Mitel · MiCollabKEVRansomwarePublic exploitLow · 2.7T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    38.2%Top 1.4%
    74.6priority
  7. CVE-2023-2868Barracuda Networks ESG Appliance Improper Input Validation Vulnerability
    Barracuda Networks · Email Security Gateway (ESG) ApplianceKEVPublic exploitCritical · 9.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    86.8%Top 0.26%
    69.8priority
  8. CVE-2023-1389TP-Link Archer AX-21 Command Injection Vulnerability
    TP-Link · Archer AX21KEVPublic exploitHigh · 8.8T1106Native APIT1070Indicator Removal+3 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    69.2priority
  9. CVE-2025-33053Microsoft Windows External Control of File Name or Path Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    87.0%Top 0.25%
    69.1priority
  10. CVE-2018-4878Adobe Flash Player Use-After-Free Vulnerability
    Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1219Remote Access Tools+1 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    90.3%Top 0.2%
    67.3priority
  11. CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059.004Unix Shell+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    24.6%Top 2.1%
    66.8priority
  12. CVE-2023-5631Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
    Roundcube · WebmailKEVPublic exploitMedium · 5.4T1204.001Malicious LinkT1059.007JavaScript+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    76.3%Top 0.46%
    66.7priority
↑ ↓ chooseEnter openEsc close