T1039: Data from Network Shared Drive
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Security context for executives and security teams
Data from Network Shared Drive matters because an attacker who already has access to one system may use that access to look through shared folders and file servers for sensitive documents before exfiltration. For leaders, the key issue is not just malware on an endpoint; it is whether normal business file sharing has become a path to broad data exposure across Windows, macOS, and Linux environments.
Executive priority
Prioritize this technique where shared drives contain regulated, confidential, operational, or executive data. Ask whether access to network shares is least-privilege, whether file access is logged well enough to support incident response and audit evidence, and whether SOC teams can distinguish normal file browsing from unusual collection activity. The relationship context includes ransomware, espionage-oriented groups, and information-stealing software, so this behavior should be treated as relevant to both data-loss readiness and business continuity planning without assuming current exposure.
Technical view
ATT&CK places T1039 in the Collection tactic across Linux, macOS, and Windows. The official description highlights searching accessible network shares from a compromised system, potentially through interactive command shells and common cmd functionality. Because MITRE does not provide official detection text here, defenders should validate coverage around authenticated access to remote shares, command-line enumeration or copying behavior, file server access patterns, and unusual volume or breadth of file reads from a single host or account. The DET0410 relationship indicates a related detection strategy exists, but the supplied fields do not include its logic, so teams should not assume coverage without reviewing their own detections.
Likely telemetry
- File server and network share access logs
- Endpoint process creation and command-line telemetry
- Authentication and session logs for accounts accessing shared drives
- File read, copy, archive, and staging activity where available
- Network connections from endpoints to file servers or shared directories
Detection direction
- Baseline normal shared-drive access by user, host, department, and file server, then look for unusual breadth, volume, timing, or access from atypical endpoints.
- Correlate process execution on compromised or suspicious hosts with subsequent access to network shares, especially command shells or common system utilities used to enumerate or copy files.
- Tune detections to reduce false positives from backup jobs, indexing, administrative maintenance, eDiscovery, and legitimate bulk file operations.
- Validate visibility across Windows, macOS, and Linux clients rather than assuming file-share monitoring is Windows-only.
- Use the related DET0410 detection strategy as a pointer for further engineering review, but confirm actual local telemetry, rule logic, and alert quality.
Mitigation priorities
- Reduce unnecessary access to shared drives through least-privilege permissions and periodic access reviews.
- Separate sensitive repositories from broadly accessible shares and require stronger controls for high-value data locations.
- Ensure file server auditing and endpoint telemetry are enabled before an incident so responders can reconstruct what was accessed.
- Monitor for abnormal collection patterns and integrate file-share activity into managed detection or SOC workflows.
- Use tabletop or incident response readiness exercises to confirm escalation paths when suspicious shared-drive access may indicate pre-exfiltration collection.
Additional notes and limits
This object is a collection technique, not an initial access or exfiltration technique. Its materiality depends heavily on local file-share design, identity permissions, logging, and the sensitivity of data stored on shared drives. Relationship context shows use by multiple ATT&CK groups, software entries, and one campaign, including ransomware and espionage-related examples, but those relationships should be used for prioritization and threat-informed defense rather than attribution in a local incident.
MITRE provides no official detection text for this technique in the supplied fields. The related detection strategy is named but not detailed. No environment-specific share architecture, identity model, logging configuration, or data classification is supplied, so detection and mitigation priorities require local validation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Data from Network Shared Drive
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G1039: RedCurl
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
G0060: BRONZE BUTLER
BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]
G0054: Sowbug
G0114: Chimera
G0045: menuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]
G0117: Fox Kitten
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
S0050: CosmicDuke
CosmicDuke is malware that was used by APT29 from 2010 to 2015. [1]
S0554: Egregor
S0458: Ramsay
S0128: BADNEWS
C0015: C0015
C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.5 | Current bundle | d61f0f270755… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]group-ib_redcurl1
Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.
Open source URL - [2]group-ib_redcurl2
Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.
Open source URL - [3]F-Secure Cosmicduke
F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
Open source URL - [4]Cybersecurity Advisory GRU Brute Force Campaign July 2021
NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
Open source URL - [5]ESET Gamaredon June 2020
Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
Open source URL - [6]ESET Gamaredon Sept2024
Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.
Open source URL - [7]Secureworks BRONZE BUTLER Oct 2017
Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
Open source URL - [8]NHS Digital Egregor Nov 2020
NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.
Open source URL - [9]Symantec Sowbug Nov 2017
Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
Open source URL - [10]Eset Ramsay May 2020
Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
Open source URL - [11]Forcepoint Monsoon
Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
Open source URL - [12]NCC Group Chimera January 2021
Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
Open source URL - [13]PWC Cloud Hopper April 2017
PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
Open source URL - [14]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [15]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL - [16]mitre-attackT1039Open source URL
- [17]mitre-attackT1039Open source URL
- [18]mitre-attackT1039Open source URL
- [19]group-ib_redcurl1
Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.
Open source URL - [20]group-ib_redcurl2
Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.
Open source URL - [21]F-Secure Cosmicduke
F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
Open source URL - [22]Cybersecurity Advisory GRU Brute Force Campaign July 2021
NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
Open source URL - [23]ESET Gamaredon June 2020
Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
Open source URL - [24]ESET Gamaredon Sept2024
Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.
Open source URL - [25]Secureworks BRONZE BUTLER Oct 2017
Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
Open source URL - [26]NHS Digital Egregor Nov 2020
NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.
Open source URL - [27]Symantec Sowbug Nov 2017
Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
Open source URL - [28]Eset Ramsay May 2020
Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
Open source URL - [29]Forcepoint Monsoon
Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
Open source URL - [30]NCC Group Chimera January 2021
Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
Open source URL - [31]PWC Cloud Hopper April 2017
PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
Open source URL - [32]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [33]CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.