Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is Exfiltration over Alternative Protocol?
Exfiltration over alternative protocol is a cyberattack technique where threat actors steal data by transferring it through a different network protocol than the one typically used by the organization. Attackers use this method to bypass security controls, evade detection, and move sensitive information outside the network.
For example, if a company primarily uses HTTP or HTTPS for business applications, an attacker may exfiltrate data through DNS, FTP, SMTP, or other less-monitored protocols. As a result, traditional security tools may overlook the suspicious traffic because it appears legitimate.
How Exfiltration over Alternative Protocol Works
Attackers first gain access to a system through malware, compromised credentials, or another intrusion method. They then identify sensitive data and package it for transfer. Instead of using the organization’s standard communication channels, they send the data through an alternative protocol that attracts less scrutiny.
Common examples include:
| Alternative Protocol | How It Is Used for Exfiltration |
|---|---|
| DNS | Encodes data within DNS queries and responses |
| SMTP | Sends stolen information through email traffic |
| FTP | Transfers files to attacker-controlled servers |
| ICMP | Hides data within network diagnostic messages |
| SMB | Moves data across compromised internal systems |
Consequently, attackers can blend malicious traffic with normal network activity, making detection more challenging.
Why Attackers Use Alternative Protocols
Threat actors favor this technique because many organizations focus monitoring efforts on common web traffic. Meanwhile, protocols such as DNS, SMTP, or ICMP often receive less inspection.
Additionally, alternative protocols can help attackers:
- Evade network filtering controls
- Bypass data loss prevention (DLP) policies
- Reduce the likelihood of triggering security alerts
- Maintain persistence during long-term attacks
This technique is recognized within the MITRE ATT&CK framework under data exfiltration methods used by advanced threat groups and cybercriminals.
How Organizations Can Detect and Prevent It
Effective defense requires visibility across all network protocols rather than only web traffic. Security teams should establish protocol baselines, monitor unusual outbound connections, and inspect traffic for anomalous behavior.
Organizations can strengthen protection by:
- Implementing network segmentation
- Enforcing least-privilege access controls
- Monitoring DNS and email traffic for anomalies
- Using data loss prevention solutions
- Conducting continuous endpoint monitoring
Furthermore, Unified Endpoint Management (UEM) platforms such as Hexnode help security teams enforce device security policies, maintain endpoint compliance, and reduce opportunities for attackers to access and move sensitive data.
FAQs
Yes. Attackers often encrypt stolen data before transmission. Therefore, organizations should combine traffic analysis with behavioral monitoring to identify suspicious communication patterns.
Industries handling large volumes of sensitive information, including healthcare, finance, government, and critical infrastructure, are frequent targets because the stolen data has significant operational or financial value.
Yes. Many modern ransomware groups steal data before encrypting systems. They may use non-standard or less-monitored protocols to transfer information and increase pressure on victims through double-extortion tactics.
