Threat actors may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.