Redundant exfiltration channels
Named by 2 kept items in this workspace.
Search every workspace for Redundant exfiltration channels. It matches the name as written, so it can find other things that share it.
The items that name it 2
Primary HTTPS POST to C2, secondary GitHub commit-based beaconing (FIRESCALE) for C2 endpoint updates, tertiary use of stolen GitHub tokens to create public repos (Russian folklore names) and upload exfiltrated data
Data exfiltrated via filev2.getsession[.]org, encrypted data committed to attacker-controlled repos via GitHub GraphQL API using stolen tokens, and a typosquat domain git-tanstack[.]com
All techniques in this workspace.