# T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol > As of 2026-10-14, T1048.002 (Exfiltration Over Asymmetric Encrypted Non-C2 Protocol) appears in 10 tracked threats, first reported 2026-05-13 and most recently 2026-10-13, with linked actors including Luna Moth, Silent Ransom Group, INC Ransom; it most often appears alongside T1071.001 (Web Protocols). - **Tracked threats:** 10 (2 critical, 8 high) - **First seen:** 2026-05-13 - **Last seen:** 2026-10-13 - **Threat actors:** 8 - **Detection rules:** 18 (counts only; Blue tier and above) ## Key facts - **ID:** T1048.002 - **Framework:** MITRE ATT&CK - **Tactics:** Exfiltration - **Matrix:** Enterprise - **Parent:** T1048 - **Data as of:** 2026-10-14 - **MITRE:** https://attack.mitre.org/techniques/T1048/002/ ## Activity timeline T1048.002 first appeared in tracked threats on 2026-05-13 and was most recently reported on 2026-10-13. The busiest month was 2026-05 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol is catalogued by MITRE ATT&CK under the Exfiltration tactic in the Enterprise matrix, as a sub-technique of [T1048 Exfiltration Over Alternative Protocol](https://intel.threadlinqs.com/technique/T1048). Threadlinqs maps 10 of 2824 tracked threats (0.4%) to it; by severity that is 2 critical, 8 high. Threats that use T1048.002 most often also use [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (7 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (6 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (6 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (5 threats), [T1657 Financial Theft](https://intel.threadlinqs.com/technique/T1657) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 8 tracked threat actors appear in the threats that use T1048.002; the most frequent are [Luna Moth](https://intel.threadlinqs.com/actor/Luna%20Moth) (2), [Silent Ransom Group](https://intel.threadlinqs.com/actor/Silent%20Ransom%20Group) (2), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) (1), [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) (1), [INC Ransomware](https://intel.threadlinqs.com/actor/INC%20Ransomware) (1). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1048.002. - [M1030 Network Segmentation](https://attack.mitre.org/mitigations/M1030/) - [M1031 Network Intrusion Prevention](https://attack.mitre.org/mitigations/M1031/) - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) - [M1057 Data Loss Prevention](https://attack.mitre.org/mitigations/M1057/) ## Data sources Telemetry that can reveal T1048.002, per MITRE ATT&CK. - Command — Command Execution - File — File Access - Network Traffic — Network Connection Creation, Network Traffic Content, Network Traffic Flow ## Threat actors using it - [Luna Moth](https://intel.threadlinqs.com/actor/Luna%20Moth) — 2 - [Silent Ransom Group](https://intel.threadlinqs.com/actor/Silent%20Ransom%20Group) — 2 - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1 - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1 - [INC Ransomware](https://intel.threadlinqs.com/actor/INC%20Ransomware) — 1 - [Lynx](https://intel.threadlinqs.com/actor/Lynx) — 1 - [SHADOW-WATER-063](https://intel.threadlinqs.com/actor/SHADOW-WATER-063) — 1 - [UNC3753](https://intel.threadlinqs.com/actor/UNC3753) — 1 ## Tracked threats 10 tracked threats use T1048.002. - [VerCellBreak: Vercel Sandbox network-allowlist bypass lets rogue AI agents exfiltrate data via crafted mTLS…](https://intel.threadlinqs.com/threat/TL-2026-3425) — high — 2026-10-13 - [Silent Ransom Group (Luna Moth) Targets US Law Firms via IT Support Impersonation and Physical Intrusion](https://intel.threadlinqs.com/threat/TL-2026-2176) — high — 2026-08-28 - [Troutman Pepper Locke LLP Data Theft Extortion by SilentRansomGroup (Repeat Attack Including Physical…](https://intel.threadlinqs.com/threat/TL-2026-2103) — high — 2026-08-21 - [AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI…](https://intel.threadlinqs.com/threat/TL-2026-2070) — critical — 2026-08-19 - [FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and…](https://intel.threadlinqs.com/threat/TL-2026-0895) — critical — 2026-06-21 - [CryptoBandits Windows Crypto-Clipper Campaign: USB LNK Worm + Tor Hidden-Service C2…](https://intel.threadlinqs.com/threat/TL-2026-0854) — high — 2026-06-18 - [AI-Generated ClickFix Campaign Delivers SmartRAT/Banana RAT PowerShell Banking Trojan Targeting Brazilian…](https://intel.threadlinqs.com/threat/TL-2026-0841) — high — 2026-06-17 - [First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion →…](https://intel.threadlinqs.com/threat/TL-2026-0619) — high — 2026-05-28 - [Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US…](https://intel.threadlinqs.com/threat/TL-2026-0612) — high — 2026-05-28 - [GemStuffer Campaign — RubyGems Registry Abused as Exfiltration Channel for UK Local Government Data](https://intel.threadlinqs.com/threat/TL-2026-0505) — high — 2026-05-13 ## Related CVEs CVEs referenced by the tracked threats that use T1048.002, most frequent first. - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) ## Detection coverage Threadlinqs maintains 18 detection rules mapped to T1048.002 (SPL 7, KQL 6, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only. 18 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1048 Exfiltration Over Alternative Protocol](https://intel.threadlinqs.com/technique/T1048) — 159 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1048.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)