Skip to content

Exfiltration to Cloud Storage

Subtechnique · ATTACK:enterprise:T1567.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1567.002",
  "title": "Exfiltration to Cloud Storage",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1567/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--bf1b6176-597c-4600-bfcd-ac989670f96b",
  "external_id": "T1567.002",
  "domain": "enterprise",
  "created": "2020-03-09T15:04:32.767Z",
  "modified": "2026-05-12T15:12:00.713Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [

  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035e7890-593f-4f70-898a-93f3302f8fac

Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--036b0dfd-5d52-4b10-9951-8d967fc8df3c

Secureworks GOLD SAHARA

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03aece39-d7a2-47a4-be1a-b1d6f1d72654

Bitdefender LuminousMoth July 2021

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08763e14-92e8-422e-b71e-bd1b0949fcc7

Checkpoint_MOISCyberCrime_Mar2026

ATTACK:enterprise:S1040 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ae24ad1-8730-4a38-8d68-dd57b335b9b4

DFIR Conti Bazar Nov 2021 · Rclone

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bcc7bc4-29ab-4e27-8b9e-e7c51343148e

Bitdefender Naikon April 2021

ATTACK:enterprise:S1023 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cfb7192-6136-4946-8ee1-498f59125b9b

Microsoft POLONIUM June 2022

ATTACK:enterprise:S0037 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e2baacb-9033-49a9-890a-f48c87ab1531

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21511746-7782-42f2-ba77-b189777ef66c

Talos Kimsuky Nov 2021 · Securonix Kimsuky February 2025

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ef7a27-1019-4ced-8a09-63351bbbc150

Trend Micro DRBControl February 2020

ATTACK:enterprise:S1170 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a6ad1b5-47a8-4eba-9780-8bb1a631613c

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f8d04f9-04af-4bf9-9841-2d7728abdf84

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Unit42 Chinese VSCode 06 September 2024

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fcc26f7-9da6-4155-af96-b826e2dfe085

TrendMicro Confucius APT Feb 2018

ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3077e0e6-4540-4f0d-a2ec-c4db78a35a0e

Microsoft POLONIUM June 2022

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b9f9fae-f68a-419b-9551-5485f8851500

Microsoft POLONIUM June 2022

ATTACK:enterprise:S1222 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d28adfe-a64f-4295-8de9-cecbe4b0c654

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4490e3-d3fe-4c2e-8c41-69ebbf8d060e

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43300665-e487-470f-a3ec-2aaeb76b2a5f

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4352e4ed-ef43-43eb-ab99-e10edba99a1c

CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46bb2079-28aa-4f64-b2d8-fb111185e419

Sygnia Emperor Dragonfly October 2022

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529460a7-ddd1-406c-bbef-ae2ec4eb4c02

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025 · Google Mandiant Storm-0501 Sabbath Ransomware November 2021

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6193189a-f24c-4680-9a20-d191f42b9c97

ESET Crutch December 2020

ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62a42fd5-ee4e-4a81-96a4-8f5396349ef9

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e137013-3837-4b56-8424-4ea6d87044b5

ESET Nomadic Octopus 2018

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--743f2f00-57d0-4df8-94db-b044e2551890

Mandiant FIN12 Oct 2021

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a9d20e3-053c-4a5c-87d6-bd72bcdd0d69

Mandiant_UNC2165

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dda2468-0344-48c5-8843-6655084d8159

Symantec Waterbug Jun 2019 · ESET ComRAT May 2020

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80efda4a-36a7-4b59-9f70-72f4952e2140

Microsoft HAFNIUM March 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8803976c-4e3d-43bf-80ec-95f3fb1f90a3

SOCRadar_MuddyWaterDindoor_Mar2026

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92b459af-5f75-4a9c-97ef-2a0be520caff

Sekoia ClickFake 2025

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98ec1cf2-91ed-4a5f-b653-1d60259d0b46

Github PowerShell Empire

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a44ba3c3-406a-49cf-9d7b-9ee7f09f9ae4

TrendMicro EarthLusca 2022

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a71e213d-1e14-4ac6-8d93-97c180ac8502

CISA GRU29155 2024

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7eecdbc-2e80-4c36-bbde-dbba10b60f70

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9fedca4-fd68-4e3f-a564-cb9c168a8e4e

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab826077-72af-4bcf-b72a-398093671b26

Google Cloud APT41 2024

ATTACK:enterprise:S0651 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b38a0fe4-6482-4c13-9def-5c8a82f31226

Checkpoint IndigoZebra July 2021

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8458076-fd1f-48e1-a637-57690c4fe59d

ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020

ATTACK:enterprise:T1567.002 → subtechnique-of → ATTACK:enterprise:T1567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd716844-74b1-4929-882f-5d85fcd2e836

ATTACK:enterprise:S1102 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb0ca294-246f-417f-bf19-9faebeb7e727

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf16ba1d-ea81-4301-a1a4-083e4a8927fe

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d17fcc24-a9ae-4841-b35b-f694b3991fba

NCC Group Chimera January 2021

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4c936f5-2221-4f6d-9d49-c6f499b07c9e

CrowdStrike Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d9a45b-0f61-43a0-93fd-7924c9307f72

Malwarebytes RokRAT VBA January 2021 · Volexity InkySquid RokRAT August 2021

ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c96864-f698-44a7-924e-98203b97c8db

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f770ba6c-df62-4bd4-ab29-34a954c4f6ac

CrowdStrike Carbon Spider August 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.