MITRE ATT&CK Technique
T1039Data from Network Shared Drive
- First Reported
- Jun 29, 2026
- Latest Reported
- Jun 29, 2026
Official Description
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
- Tactics
- Collection
- Platforms
- Linux, macOS, Windows
- MITRE Version
- 1.5
- Last Modified
- Oct 24, 2025
Reported Context (1)
- The threat actor accessed network shares and likely exfiltrated SYSVOL data. Bing SEO Poisoning Led to BumbleBee, AdaptixC2 and Akira Ransomware Intrusions
Malware (2)
People (7)
MITRE ATT&CK (36)
Vendors (4)
Products (6)
Tools (13)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.