T1567.002

Exfiltration to Cloud Storage

discovered 2026-06-11

Fallback exfiltration via POST /upload to the public file-sharing service temp.sh over Tor when the primary C2 is unavailable.

View on MITRE ATT&CK

Seen in packages

Campaigns