Threat intelligence / Technique

Exfiltration to Code Repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

6 recorded

Relationships

mitigates

from Restrict Web-Based Content

Mitigation

subtechnique-of

to Exfiltration Over Web Service

Technique

uses

Tool

uses

from Mini Shai-Hulud

Malware

uses

from Shai-Hulud

Malware

uses

from TeamPCP Cloud Stealer

Malware

1 external

References

mitre-attack

T1567.001