Exfiltration Over Web Service: Exfiltration to Code Repository

Threat Actors may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

ID: ATAGS-T1203.001
Sub-technique of:  ATAGS-T1203
Tactic: Exfiltration
Targeted Components: Network Transport
Responsibility: Shared
Created: 18 April 2026
Last Modified: 18 April 2026

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.