Catalin CimpanuCisco Talos has published a useful report on all the exfiltration methods used by ransomware groups in the past to siphon data from compromised networks
Everyday tools, extraordinary crimes: the ransomware exfiltration playbook
Attackers use trusted tools for data theft, making traditional detection unreliable. The Exfiltration Framework enables defenders to spot exfiltration by focusing on behavioral signals across endpoints, networks, and cloud environments rather than static tool indicators.