Skip to content
Threat Feed

Tag

Data Exfiltration

13 briefs RSS
medium advisory

Potential Data Exfiltration via Rclone

Attackers are abusing the legitimate file synchronization tool rclone, often renamed to masquerade as legitimate software, to exfiltrate data to cloud storage or remote endpoints.

Elastic Defend data-exfiltration rclone masquerading
2r 3t
high threat

Trigona Ransomware Employing Custom Data Exfiltration Tool

Trigona ransomware is using a custom data exfiltration tool named 'uploader_client.exe' to steal data from compromised environments, enhancing speed and evasion.

Windows +3 Trigona ransomware data exfiltration custom tool
2r 4t 1i
low advisory

Unusual Spike in Bytes Written to External Device Detected by Machine Learning

A machine learning job has detected a spike in bytes written to an external device, which is anomalous and can signal illicit data copying or transfer activities, potentially leading to data exfiltration.

data exfiltration machine learning external device
2r 1t
high advisory

CrowdStrike Falcon AIDR Supports NVIDIA NeMo Guardrails for AI Agent Protection

CrowdStrike Falcon AIDR now supports NVIDIA NeMo Guardrails, providing enterprise-grade protection for AI agents by defending against runtime attacks like prompt injection, redacting sensitive data, defanging malicious content, and moderating unwanted topics to ensure agents stay within compliance boundaries in sectors like finance, healthcare, customer service, and software development.

ai-security prompt-injection data-exfiltration
2r 2t
high advisory

Speagle Malware Hijacks Cobra DocGuard for Data Exfiltration

The Speagle malware hijacks the Cobra DocGuard application to exfiltrate sensitive data from infected machines to attacker-controlled Cobra DocGuard servers, effectively masking malicious traffic as legitimate DocGuard communication.

malware data-exfiltration cobra-docguard speagle
2r 1t
critical advisory

Apache Artemis and ActiveMQ Artemis Authentication Bypass Vulnerability

CVE-2026-27446 allows an unauthenticated remote attacker to inject malicious messages or exfiltrate data from Apache Artemis and ActiveMQ Artemis brokers due to a missing authentication check in the Core protocol.

apache-artemis apache-activemq authentication-bypass message-injection data-exfiltration
2r 5t
low advisory

Potential Data Exfiltration to Unusual Geographic Region via Machine Learning

A machine learning job has detected potential data exfiltration activity to an unusual geographical region, specifically by region name, indicating exfiltration over command and control channels.

data-exfiltration machine-learning network-traffic
2r 1t
low advisory

Unusual Remote File Size Indicating Lateral Movement

A machine learning job has detected an unusually high file size shared by a remote host, indicating potential lateral movement as attackers bundle data into a single large file transfer to evade detection when exfiltrating valuable information.

lateral-movement data-exfiltration machine-learning
2r 3t
low advisory

Spike in Bytes Sent to an External Device via Airdrop

A machine learning job has detected a spike in bytes of data written to an external device via Airdrop, potentially indicating illicit data copying or transfer activities.

data-exfiltration macos airdrop
2r 1t
low advisory

Machine Learning Detects High Bytes Written to External Device

A machine learning job has detected high bytes of data written to an external device, potentially indicating illicit data copying or transfer activities leading to data exfiltration over a physical medium such as USB.

data-exfiltration machine-learning endpoint
2r 1t
low advisory

Unusual Process Writing Data to an External Device via Machine Learning

A machine learning job detects a rare process writing data to an external device, potentially indicating data exfiltration masked by benign-looking processes.

data-exfiltration machine-learning elastic-defend
2r 1t
medium advisory

Mounting of Hidden or WebDav Remote Shares via Net Utility

Adversaries may leverage the `net.exe` utility to mount WebDav or hidden remote shares, potentially indicating lateral movement, data exfiltration preparation, or initial access via discovery of accessible shares.

Elastic Defend +2 lateral-movement data-exfiltration windows
2r 4t
medium advisory

Large ICMP Traffic Detection

This analytic identifies excessive ICMP traffic to external IP addresses exceeding 1,000 bytes, potentially indicating command and control activity, data exfiltration, or covert communication channels.

Splunk Enterprise +4 network-traffic command-and-control data-exfiltration
2r 1t