Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)

Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks)

Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP)

Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.
Traffic Duplication
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1020/001  external_id: T1020.001     source_name: AWS Traffic Mirroring  description: Amazon Web Services. (n.d.). How Traffic Mirroring works. Retrieved March 17, 2022.  url: https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-how-it-works.html     source_name: Cisco Traffic Mirroring  description: Cisco. (n.d.). Cisco IOS XR Interface and Hardware Component Configuration Guide for the Cisco CRS Router, Release 5.1.x. Retrieved October 19, 2020.  url: https://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r5-1/interfaces/configuration/guide/hc51xcrsbook/hc51span.html     source_name: GCP Packet Mirroring  description: Google Cloud. (n.d.). Packet Mirroring overview. Retrieved March 17, 2022.  url: https://cloud.google.com/vpc/docs/packet-mirroring     source_name: Juniper Traffic Mirroring  description: Juniper. (n.d.). Understanding Port Mirroring on EX2200, EX3200, EX3300, EX4200, EX4500, EX4550, EX6200, and EX8200 Series Switches. Retrieved October 19, 2020.  url: https://www.juniper.net/documentation/en_US/junos/topics/concept/port-mirroring-ex-series.html     source_name: Azure Virtual Network TAP  description: Microsoft. (2022, February 9). Virtual network TAP. Retrieved March 17, 2022.  url: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-tap-overview     source_name: Cisco Blog Legacy Device Attacks  description: Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.  url: https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954     source_name: US-CERT-TA18-106A  description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.  url: https://www.us-cert.gov/ncas/alerts/TA18-106A     