ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: IF001.003
  • Created: 31st May 2024
  • Updated: 23rd October 2025
  • Platforms: WindowsLinuxMacOS
  • MITRE ATT&CK®: T1567.003T1567
  • Contributor: The ITM Team

Exfiltration via Text Storage Sites

A subject uses a text storage service, such as Pastebin, to exfiltrate data. They will then access that service again on another device to retrieve the data. Examples include (URLs have been sanitized):

  • hxxps://pastebin[.]com
  • hxxps://hastebin[.]com
  • hxxps://privatebin[.]net
  • hxxps://controlc[.]com
  • hxxps://rentry[.]co
  • hxxps://dpaste[.]org