MITRE ATT&CK Technique
T1537Transfer Data to Cloud Account
- First Reported
- Oct 27, 2025
- Latest Reported
- Jun 26, 2026
Official Description
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks)
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature)
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.(Citation: TLDRSec AWS Attacks)
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.(Citation: Microsoft Azure Storage Shared Access Signature)
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.(Citation: DOJ GRU Indictment Jul 2018)
- Tactics
- Exfiltration
- Platforms
- IaaS, Office Suite, SaaS
- MITRE Version
- 1.5
- Last Modified
- Oct 24, 2025
Reported Context (2)
- The operator attached S3 data-lake policies and used AssumeRole sessions named exfil-related values in activity assessed as exfiltration tradecraft. Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theft
- The article lists this ID for cloud-account transfer; Cyberduck history showed a Backblaze host configured as the destination for large-file transfers. Cisco Talos Details Qilin Ransomware Tactics, from VPN Access to Network Encryption
Malware (6)
People (4)
Threat Actors (2)
MITRE ATT&CK (40)
Vendors (2)
Products (14)
Tools (22)
Industries (10)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.