H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.

14 recorded

Relationships

mapped-toTechnique
uses
from APT28
Group
uses
from BADNEWS
Malware
usesGroup
uses
from C0015
Campaign
uses
from Chimera
Group
usesMalware
uses
from Egregor
Malware
usesGroup
usesGroup
usesGroup
uses
from Ramsay
Malware
uses
from RedCurl
Group
uses
from Sowbug
Group
1 external

References

mitre-attack
T1039
open