Exfiltration Over Other Network Medium

T1011 'Exfiltration Over Other Network Medium' is the exact-concept ATT&CK exfiltration-tactic technique for using a non-primary network medium to exfiltrate data; SPARTA EXF-0004 'Out-of-Band Communications Link' is the spacecraft instance (use secondary/maintenance/beacon channels for covert data movement). Tactic and activity align directly.

Proximity operations exfiltration uses a co-orbital/proximate vehicle as a TEMPEST/EMSEC sensor capturing emanations and weak crosslink leakage — this is exfiltration via a non-primary network medium (the proximity-RF channel). T1011 'Exfiltration Over Other Network Medium' covers the conceptual pattern; cross-domain moderate honors that MITRE's typical example is Bluetooth-style enterprise alternate links.

Modifying communications configuration to create covert downlink/crosslink paths is creating an alternate-medium exfil channel — direct match for T1011 'Exfiltration Over Other Network Medium'. The reconfigured carrier/subcarrier/virtual-channel becomes the non-primary medium. Tactic-aligned.

SDR reconfiguration (adding subcarriers, changing modulation, scheduling maintenance bursts) creates an alternate exfil medium piggybacking on the standard waveform — exact instance of T1011 applied to programmable-radio reconfiguration.

Transponder reconfiguration (remapping inputs/outputs, shifting translation, enabling auxiliary ports) routes mission data to non-mission receivers — exact instance of T1011 applied to bent-pipe/regenerative transponder configuration.

Payload communication channels (direct-to-user terminals, customer VPN-tunneled feeds, experimenter relay paths) are non-primary network media distinct from the TT&C channel — SPARTA EXF-0010 covers using these for exfil, exact match for T1011 'Exfiltration Over Other Network Medium'. Tactic-aligned.