Skip to content

Automated Exfiltration

Technique · ATTACK:enterprise:T1020

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1020",
  "title": "Automated Exfiltration",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1020",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
  "external_id": "T1020",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:29.458Z",
  "modified": "2026-05-12T15:12:00.642Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "exfiltration"
  ],
  "source_references": [
    {
      "source_name": "ESET Gamaredon June 2020",
      "url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e3ea008-1a5e-4f58-aaa9-4da690539908

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a853e5a-1529-4ac0-8c17-48461e29c4ca

Aryaka Kimsuky July 2025

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b1fb532-84e3-4f77-962c-038c798d239e

ESET LightNeuron May 2019

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2caa19fb-fe02-4365-b53a-1ff554a13889

Talos Frankenstein June 2019

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d2736f6-5ce8-48ba-8be0-e8d8ab0a3a9c

ATT Sidewinder January 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45608b9a-ddd8-45f9-9152-bed384a1c8c3

Talos Frankenstein June 2019

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a007e42-2efb-4ace-aa08-950bbee11df7

Intezer Doki July 20

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5521901f-ca97-4904-9d98-1b3e61ffc38d

CCCS ArcaneDoor 2024

ATTACK:enterprise:S0090 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59261bc8-0220-4e37-8018-7a3618a5dd1b

Palo Alto Rover

ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--667592ad-e249-4efd-933f-75a53b25567a

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0643 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--672f33f6-bdc1-40b2-a208-888d1002cc25

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cf0d062-e441-48ca-b675-2f01ae333b74

ESET Machete July 2019

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ff6558d-3efb-4219-8d47-ecf82755ccf1

ESET Windigo Mar 2014 · ESET Ebury May 2024

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72513bb1-7e36-415f-a6bd-4b1a908509ef

Sekoia Raccoon2 2022 · Sekoia Raccoon1 2022 · S2W Racoon 2022

ATTACK:enterprise:S1166 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73df85c1-c019-4d73-9c1d-98faea3d48c2

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S1211 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75fc48f0-fafe-45b8-aeae-53e26487e642

Symantec Bilbug 2022

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78ad31db-6b8e-4433-88b8-49c22994a2ab

Microsoft NICKEL December 2021

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94149a91-d3c4-4893-938d-4f8964aeb5d7

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cc4cd5d-7b10-4dd7-8fd9-90288aa8b5be

Kaspersky TajMahal April 2019

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a16a3223-06a6-453d-b044-f683bda1bf2a

CERT-UA WinterVivern 2023

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ace245e2-6972-4247-9b08-4c6a375cfce7

Wiz Trivy Compromise MAR 2026

ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad3b3ea9-04f8-42f7-b88a-0d33fdb3854e

FBI Salesforce Data Theft SEP 2025

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae8a95fa-c0ad-40b4-a573-a9441ed94fab

ESET Sednit USBStealer 2014

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be7f2951-ce33-4d48-ad9c-69071e54ae18

ESET Crutch December 2020

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f1371c-8f23-49b7-9572-d226ee2dbade

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c623d41f-3af0-4e3a-bf4f-8550bec85b37

ESET Gamaredon June 2020

ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d894e46e-1967-4499-83d5-626a8e49a97a

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ac067b-f246-40bb-98bd-fcff74092139

F-Secure Cosmicduke

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f49a45b8-6efb-4ac5-8714-9dfd9b31edbd

ESET Attor Oct 2019

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7539748-0911-4a98-a98f-f512d1424d85

DCSO StrelaStealer 2022 · IBM StrelaStealer 2024

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f94b493a-303c-4c46-a14f-21d993c1bf21

AI-Mexico-Govt-Breach

ATTACK:enterprise:T1020.001 → subtechnique-of → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd44a14f-1ca5-4356-a6fe-c5507a77d490

ATTACK:enterprise:S0131 → uses → ATTACK:enterprise:T1020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff922dd7-21b6-4f95-bb8b-080d0dee6655

Forcepoint Monsoon

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.