The objective of a cyberattacker is often to extract data. According to the MITRE ATT&CK framework, exfiltration is the second-to-last step in their multiphase approach to a cyberattack. It takes place after gaining access to the target’s network, locating valuable data, avoiding detection, and maneuvering to the location where the data is kept. In the ATT&CK framework, only command and control (C2) follows exfiltration. However, since data is typically the end goal, the attacker may not even bother with C2.
Cyber defenders are facing a situation that could be either positive or negative. On the bright side, they have numerous opportunities to prevent an attacker from stealing data. However, this means that attackers also have many opportunities to access the data.
A data exfiltration attack from an outside source begins when a hacker breaches a company’s system to obtain sensitive data, including user passwords, or through the use of APIs, which offer the easiest route for accessing data. Hackers typically insert harmful software into devices used by end users, such as computers or phones connected to the company’s network.
After infiltrating an organization’s systems and devices, malware can rapidly proliferate while targeting valuable corporate data for theft. It is adept at evading the organization’s security measures until it successfully fulfills its objectives, whether by swiftly gathering a large amount of data or slowly accumulating small pieces of information without being detected.
Corrupt insiders also pose a dangerous threat to organizations. They can quickly steal confidential data and move it out of the organization via email or cloud storage for their financial gain. Mistakes made by personnel can also cause security breaches. For example, an internal user could unknowingly leak data from the network by forwarding it to their personal email or saving it on unprotected cloud-based services and software platforms. While these actions may seem harmless, they inadvertently create vulnerabilities that are outside the purview of the organization’s security team.
One of the primary obstacles in preventing data exfiltration attacks is distinguishing between legitimate and malicious data exports. It can be difficult to determine if a user downloading a file is engaging in cyberattack activity or simply performing their job duties. Similarly, it can be challenging to identify whether encrypted data leaving an organization’s network is part of a normal business transaction or a malicious attack.
During the infamous Sony Pictures hack, a vast amount of information was extracted from the company’s network in an encrypted state over several months without detection, exposing a major flaw in their anti-exfiltration measures. This isn’t an isolated issue, as it affects every organization in some capacity.
