T1567

Official Description

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Tactics: Exfiltration
Platforms: ESXi, Linux, macOS, Office Suite, SaaS, Windows
MITRE Version: 1.5
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Sub-techniques (4)

T1567.001 · Exfiltration to Code RepositoryT1567.002 · Exfiltration to Cloud StorageT1567.003 · Exfiltration to Text Storage SitesT1567.004 · Exfiltration Over Webhook

Reported Context (3)

The movinlike bundle exfiltrates stolen data to a Discord webhook. MALFEX: Malicious npm Supply-Chain Campaign Went Unadvised for 14 Months
The scanner sent discovered URLs and public IP addresses to Telegram in an attachment named red.Txt. Attackers Exploit Telerik CVE-2019-18935 to Install Web Shells and Scan for Exposed WordPress Pages
Lure pages reported visitor details through a messaging bot API. CSuite Campaign Uses Phishing, M365 Session Theft and Remote-Access Tools Against US and EU Organizations

CVE (1)

Malware (4)

Threat Actors (2)

MITRE ATT&CK (37)

Vendors (11)

Products (20)

Tools (5)

Industries (6)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.