Data Exfiltration. As mentioned earlier in this document, attackers will often direct their efforts to steal sensitive data from their chosen targets. The term data exfiltration is commonly used to designate the techniques employed to take advantage of a successful intrusion on an organization's communication system to steal information stored on its servers, transferring the data to an external repository through an unauthorized connection while trying to avoid detection. Attacks targeting data storage systems and making use of advanced persistent threats (APT) are carried out over long time spans and often go unnoticed for months or years before being finally discovered by information security personnel, and even Figure 31 – A typical data exfiltration architecture: data found on endpoints and collected by an aggregator is transferred to a set of external dump servers [200] then the initial symptoms might not even reveal the full scope of the breach, its duration and the relevance of the resulting damage. Groups engaging in this kind of attacks, characterized by the employment of sophisticated tools and a continuous control over the flow of information, are normally classified as APT groups, and they will often be driven by motives of political antagonism or international, military or industrial espionage. In these contexts, data exfiltration can cause significant and irreparable damage. Social engineering techniques are employed to infiltrate the network,62 typically delivering specially-crafted phishing messages to individuals either employed by an organization or temporarily granted special privileges and access credentials, such as contractors [202]. As soon as a file containing the malicious payload is opened, attackers gain a foothold within the organization's systems, which they can then rely on in order to escalate privileges and start collecting whatever intelligence they are after. The actions required to make the breach and carry out the theft will often go unnoticed, appearing as perfectly legitimate activity performed by authorized personnel. A famous example of this procedure is the Carbanak63 case [209]. 62 In July 2015, the United States government revealed the discovery of a major breach in the computer systems holding data pertaining to the activities of the Office of Personnel Management. Almost 20 million records were stolen, containing private sensitive data belonging to current and former federal employees, including social security numbers, health, c...
