Activity timeline
T1048.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol is catalogued by MITRE ATT&CK under the Exfiltration tactic in the Enterprise matrix, as a sub-technique of T1048 Exfiltration Over Alternative Protocol. Threadlinqs maps 10 of 2824 tracked threats (0.4%) to it; by severity that is 2 critical, 8 high.
Threats that use T1048.002 most often also use T1071.001 Web Protocols (7 threats), T1005 Data from Local System (6 threats), T1685 Disable or Modify Tools (6 threats), T1036.005 Match Legitimate Resource Name or Location (5 threats), T1657 Financial Theft (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
8 tracked threat actors appear in the threats that use T1048.002; the most frequent are Luna Moth (2), Silent Ransom Group (2), INC Ransom (1), INC Ransom - G1032 (1), INC Ransomware (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1048.002.
Data sources
Telemetry that can reveal T1048.002, per MITRE ATT&CK.
- Command — Command Execution
- File — File Access
- Network Traffic — Network Connection Creation, Network Traffic Content, Network Traffic Flow
Threat actors using it
Tracked threats
10 tracked threats use T1048.002.
- VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS…high
- Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusionhigh
- Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical…high
- AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI…critical
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and…critical
- CryptoBandits Windows Crypto-Clipper Campaign: USB LNK Worm + Tor Hidden-Service C2…high
- AI-Generated ClickFix Campaign Delivers SmartRAT/Banana RAT PowerShell Banking Trojan Targeting Brazilian…high
- First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion →…high
- Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US…high
- GemStuffer Campaign — RubyGems Registry Abused as Exfiltration Channel for UK Local Government Datahigh
Detection coverage
Threadlinqs maintains 18 detection rules mapped to T1048.002 (SPL 7, KQL 6, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1048 Exfiltration Over Alternative Protocol — 159 tracked threats at the technique level.