backfiltrering

Backfiltrering is a term used in cybersecurity and network security to describe a specific type of attack or data exfiltration technique. It generally refers to the process where an attacker, after gaining initial access to a network, uses the compromised system as a pivot point to access and exfiltrate data from other systems within the same network or even from external networks that the compromised system can reach. This differs from direct exfiltration where data is sent out from the initially compromised machine.

In backfiltrering, the attacker might use the compromised system to establish a covert channel or a proxy to transfer sensitive information. This can involve transferring data to an attacker-controlled server or to another system within the victim's network that is less monitored or has weaker security controls. The term "back" in backfiltrering implies that the data is being moved "back" into the compromised environment or laterally within it before being sent outwards, often to evade detection mechanisms that are looking for direct egress traffic from the initial point of compromise.

This technique can be employed after a successful phishing attack, exploitation of a vulnerability, or through the use of malware. The goal is to move laterally within a network, discover valuable data, and then exfiltrate it in a way that is harder to trace back to the original entry point. Security professionals often implement network segmentation, strict access controls, and vigilant monitoring for unusual internal data transfers to detect and prevent backfiltrering attempts.