Data Exfiltration to Easyupload.io via WinSCP (T1567.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects network activity initiated by the WinSCP utility, or DNS queries and HTTP requests directed toward easyupload.io, a common file-sharing site. This behavior may indicate an adversary staging or exfiltrating data to an external, potentially unauthorized location.