Attacks and malware
What is Exfiltration?
Moving stolen data out of the victim environment to somewhere the attacker controls.
Exfiltration is moving stolen data out of the victim environment to a place the attacker controls. It is the step that turns access into loss.
Attackers use whatever is least likely to be noticed: cloud storage services, file transfer tools, encrypted archives over HTTPS, and sometimes DNS. Large uploads at unusual hours, new cloud destinations and archiving tools run on servers are common signs.