aol.pm

Exfiltration Over Unencrypted Non-C2 Protocol

Subtechnique · ATTACK:enterprise:T1048.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1048.003",
  "title": "Exfiltration Over Unencrypted Non-C2 Protocol",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1048/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b",
  "external_id": "T1048.003",
  "domain": "enterprise",
  "created": "2020-03-15T15:37:47.583Z",
  "modified": "2026-09-03T19:46:40.087Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [
    {
      "source_name": "copy_cmd_cisco",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    }
  ]
}

Explicit source assertions (40)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a8ee649-e907-4a73-8513-3019b2d771a0

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10caa62d-432a-4b17-803b-095ad6d6bd45

CERT Polska

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177950ec-8f25-4243-8d9d-a15e24ff7c98

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a493d52-b97f-4cf3-a85b-1e9aaa66a410

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ce50a6a-5f0b-40ca-9a71-41369ae3fdcd

Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22d01548-0512-4acb-a386-51ec7a822329

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24a9d604-0e19-4458-953b-7985b862bfaa

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1116 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27753f1a-96fc-4139-a19b-504f488035d7

Mandiant Cutting Edge Part 2 January 2024 · Mandiant Cutting Edge January 2024

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27c397ca-aaa1-4cf5-b663-bde9b82050a6

Medium KONNI Jan 2020

ATTACK:enterprise:S0252 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28a113cd-efdc-49cf-b6d2-c967e11de751

McAfee Gold Dragon

ATTACK:enterprise:S0674 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37d0c8b8-0b5e-4da5-bd35-5265b8f9d390

Check Point APT35 CharmPower January 2022

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4dabc2-3bee-409a-a05d-e107677cfdc7

F-Secure Cosmicduke

ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4612c0bd-f6f7-4c71-92dd-9f26ff1c3eef

Symantec Thrip June 2018

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46fa464b-20e0-4c77-9b75-580f9f236c43

ESET OceanLotus Mar 2019

ATTACK:enterprise:S0212 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--499b83f9-ba2a-4de3-a143-ed85677a453d

FireEye APT37 Feb 2018

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50968078-c2bd-4822-895e-69983a37b235

CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--509f6586-94b5-482b-b0dd-09f704c9417f

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bb4954e-9e07-48c8-8733-2fee8625a723

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fe0a46c-7a06-4aea-9768-d611d3f3116d

DFIR Ryuk's Return October 2020 · DFIR Ryuk 2 Hour Speed Run November 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60c1b489-f1fc-4568-aba0-54e932715abc

Talos Agent Tesla Oct 2018 · Bitdefender Agent Tesla April 2020 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--613ba18d-d23b-443a-9e1a-c2d564132fe2

Talos PoetRAT April 2020

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c10da0b-4dfd-4389-b3e3-3599a2fab859

Mandiant APT41

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70495f42-0a81-485c-8f30-c75af61f1c6a

Trend Micro Earth Simnavaz October 2024 · Palo Alto OilRig Oct 2016

ATTACK:enterprise:T1048.003 → subtechnique-of → ATTACK:enterprise:T1048

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76d837ed-157b-44e0-a6bf-189ffc3239c3

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f104e2e-4816-4551-b4a6-9f0ed1e01218

ESET Carbon Mar 2017

ATTACK:enterprise:S0190 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95415ffd-265d-448f-bb39-73c7721d5c42

Microsoft BITSAdmin

ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96667f6c-e625-4696-92b5-d65d142b3f43

hexed osx.dok analysis 2019

ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bc3bb1f-6b1d-4267-95d8-ce4577f8fb1a

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c4621d7-76b4-4af5-838e-391236f521d2

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a501c3c3-66f7-4128-bf47-b6bf816d5411

Symantec Elfin Mar 2019

ATTACK:enterprise:S0095 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac3ee298-bef0-4a52-9050-3dcef1701408

Microsoft FTP · Linux FTP

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1c7a31e-1920-4750-bdd6-bd4c9908c319

TechNet Firewall Design

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9349020-d0b1-4d48-94f1-74a4f3c79185

Trend Micro FIN6 October 2019

ATTACK:enterprise:S0487 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c291bd7d-bf11-4be0-8d31-77055bb7675a

ESET ForSSHe December 2018

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d811dad0-a813-4293-81fc-55e8ea6a54be

objective-see windtail2 jan 2019

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2498e90-b4dc-4ef4-b1e5-d34537a2f4b2

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3b20c80-7b6e-4a0a-8e69-f2d948cadd0e

Red Canary SocGholish March 2024

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec1c1a92-8c19-4b09-9722-9db244ec30ca

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

ATTACK:enterprise:S0107 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed2c177c-18fc-4bfd-9169-48af1557a542

Trustwave Cherry Picker

ATTACK:enterprise:S1040 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fba63e06-710f-4f04-b446-be8509ea0a5e

Rclone

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.