Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Exfiltration Over C2 Channel
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1041  external_id: T1041     source_name: University of Birmingham C2  description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.  url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf     