Huntress Details Data Exfiltration Tactics Used in Ransomware Incidents
Summary
Huntress analysts describe attackers staging and exfiltrating data with tools such as WinRAR, RClone, backup utilities and s5cmd, and explain detection challenges, including a Qilin incident involving exposed RDP and disabled Defender protections.
Key points
- Attackers commonly stage data in archives with tools such as 7-Zip and WinRAR before exfiltration; Huntress also observed GoFile[.]io and MEGASync.
- Observed exfiltration methods include native Windows utilities, FileZilla's SFTP module, RClone, Restic, BackBlaze and WinSCP.
- In a Qilin ransomware incident, the actor accessed infrastructure through an exposed RDP instance and used s5cmd to copy selected files to S3-compatible storage before deploying ransomware with PsExec.
- Windows event logs in the Qilin incident showed Defender real-time protection and other functionality being disabled.
- Huntress reports that its 2025 Cyber Threat Report found data exfiltration occurred immediately before ransomware deployment in more than 70% of ransomware attacks.
- Detection is difficult because attackers' use of legitimate tools and system utilities can resemble normal administrative activity; defenders need context about legitimate business processes.
Article Details
- Attack Vectors
- Threat actors stage collected data in archives using tools such as WinRAR and 7Zip before exfiltration.
- Data is exfiltrated with native Windows utilities, including finger.exe, ftp.exe, and bitsadmin.exe, as well as fzsftp.exe, RClone, Restic, BackBlaze, WinSCP, and s5cmd.
- In a Qilin ransomware incident, the threat actors accessed the environment through an exposed RDP instance, used s5cmd to exfiltrate files to S3-compatible storage, and then used PSExec to deploy and launch ransomware across endpoints.
- The article reports that ransomware threat actors often exfiltrate data before file encryption as part of double-extortion activity.
- Defensive Notes
- Monitor for data-staging and exfiltration behavior involving archival tools, native utilities, backup software, and cloud-transfer tools.
- Interpret suspicious activity in the context of legitimate business processes to reduce false positives.
- Review Windows Defender event logs for indications that real-time protection or other Defender functionality has been disabled.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolIn the Qilin incident, the threat actors accessed the environment through an exposed RDP instance.T1041 · Exfiltration Over C2 ChannelThe article reports data exfiltration through tools including RClone, Restic, BackBlaze, and s5cmd.T1048 · Exfiltration Over Alternative ProtocolThe article describes collected data being transferred out using FTP, SFTP, backup utilities, and cloud-transfer tools.T1059.003 · Windows Command ShellThe article provides command lines used to run Windows executables such as 7zG.exe, WinRAR.exe, and s5cmd.exe.T1560.001 · Archive via UtilityThreat actors used WinRAR and 7Zip to archive collected files before exfiltration.T1562.001 · Disable or Modify ToolsIn the Qilin incident, Windows Defender real-time protection and additional Defender functionality were disabled.T1567.002 · Exfiltration to Cloud StorageThreat actors used GoFile.io cloud storage and other cloud-storage services to exfiltrate staged data.T1570 · Lateral Tool TransferThe Qilin threat actors used PSExec to push the ransomware executable to other endpoints.
People
Malware
BlackCatThe following example command lines include Restic being observed during a BlackCat ransomware campaign, and BackBlaze (b2.exe) being observed during an INC ransomware incident, respectively:INC ransomwareThe following example command lines include Restic being observed during a BlackCat ransomware campaign, and BackBlaze (b2.exe) being observed during an INC ransomware incident, respectively:QilinIn a recent Qilin ransomware attack, Huntress observed threat actors using an open source tool named s5cmd.
Products
7ZipThreat actors often stage data through the use of archival tools; WinRAR and 7Zip are two such tools commonly observed across a wide range of incidents.BackBlazeOther observed methods of data exfiltration include the use of RClone for syncing files to the cloud, or backup utilities such as Restic and BackBlaze.FileZillaDuring several incidents, Huntress analysts have observed threat actors downloading and installing both WinRAR and FileZilla, ultimately exfiltrating staged data via fzsftp.exe, FileZilla’s SFTP module.rcloneData exfiltration: LOLBins, backup utilities, and RCloneResticOther observed methods of data exfiltration include the use of RClone for syncing files to the cloud, or backup utilities such as Restic and BackBlaze.Windows DefenderFor example, the Windows Defender Event Log contained a Microsoft-Windows-Windows Defender/5001 event, indicating that Windows Defender’s Real-Time Protection (RTP) functionality had been disabled.WinRARThreat actors often stage data through the use of archival tools; WinRAR and 7Zip are two such tools commonly observed across a wide range of incidents.WinSCPThe above command included an extensive list of folders to extract files from, and was followed shortly thereafter by the threat actor downloading, installing, and employing WinSCP.
Tools
bitsadminOther native utilities, such as ftp.exe or bitsadmin.exe, have been used in a similar manner by threat actors to move data they’ve collected from the compromised endpoint to their own systems.finger.exeFor example, Huntress once observed a threat actor performing reconnaissance activities where they used the living-off-the-land binary (LOLBin) finger.exe to exfiltrate a process listing from an endpoint.ftp.exeOther native utilities, such as ftp.exe or bitsadmin.exe, have been used in a similar manner by threat actors to move data they’ve collected from the compromised endpoint to their own systems.fzsftp.exeDuring several incidents, Huntress analysts have observed threat actors downloading and installing both WinRAR and FileZilla, ultimately exfiltrating staged data via fzsftp.exe, FileZilla’s SFTP module.PsExecThey then used s5cmd.exe for data exfiltration before using PSExec to push the ransomware executable (svchosts.exe) and launch it on other endpoints.s5cmdS5cmd for data exfiltration