T1041 Exfiltration Over C2 Channel

2 threats tracked by Spectrum Delta use this technique.

T1041 on MITRE ATT&CK →

• Aokigahara AI-session stealer

  X25519/AES-GCM chunked exfiltration to /gate C2

  DNS/flow telemetry: connections to the C2 set (destination observation). The /gate/* paths, User-Agent and X-* headers require HTTP-content capture or application instrumentation — and decryption where transport is encrypted; they are not generally available in firewall/flow records. Endpoint correlation (process-to-network) ties the flows to the stealer process

  Seen in: Network / proxy

• LiteLLM 1.107.0 backdoor

  Collector exfiltration POST to litellm[.]dev/healthcheck

  Proxy access logs (cs-host litellm.dev), DNS query logs, MDE DeviceNetworkEvents RemoteUrl

  Seen in: Web proxy / DNS logs, Microsoft Defender for Endpoint / Sysmon