File-Transfer

Attackers can leverage the legitimate Windows print.exe utility to perform unauthorized remote file copying, facilitating data staging and exfiltration.

Attackers can leverage the findstr.exe utility to download or read content from remote SMB shares using specific command-line arguments, potentially facilitating file exfiltration or second-stage payload delivery.

Versions of rsync prior to 3.5.0 contain multiple command and argument injection flaws that allow attackers to execute arbitrary code via malicious hostnames, environment variables, and shell command injections.

Multiple vulnerabilities in Progress Software MOVEit Transfer allow attackers to bypass security measures, achieve elevated privileges, and manipulate or disclose sensitive data, including the ability to perform Cross-Site-Scripting (XSS) attacks.

A critical insecure direct object reference (IDOR) vulnerability, CVE-2026-28302, in SolarWinds Serv-U allows authenticated group administrators to achieve privilege escalation and remote code execution as root.

A path traversal vulnerability exists in electerm's Zmodem and Trzsz file download handlers (CVE-2026-49253), allowing a malicious SSH server to send specially crafted filenames (e.g., `../escaped.txt`) that, when accepted by the user, can cause files to be written to arbitrary locations on the user's filesystem, potentially overwriting sensitive files or introducing malicious content.

Adversaries may abuse Curl for Windows to download files or upload data to a remote URL for command and control or exfiltration purposes.

Adversaries leverage the Windows Background Intelligent Transfer Service (BITS) to download executable and archive files, potentially delivering malicious payloads while evading traditional security measures.