diff --git a/modules/connectivity/data_exfil.py b/modules/connectivity/data_exfil.py
index d07bc0d..2e32052 100644
--- a/modules/connectivity/data_exfil.py
+++ b/modules/connectivity/data_exfil.py
@@ -349,13 +349,25 @@ class DataExfil(BaseModule):
 
         remote_path = f"{self._remote_user}@{remote_host}:{self._remote_base}/"
 
-        # Build SSH options
+        # Build SSH options — use known_hosts for host key verification
+        exfil_cfg = self.config.get("connectivity", {}).get("data_exfil", {})
         ssh_opts = [
-            "-o", "StrictHostKeyChecking=no",
-            "-o", "UserKnownHostsFile=/dev/null",
+            "-o", "StrictHostKeyChecking=accept-new",  # Accept only if not seen before
             "-o", "LogLevel=ERROR",
             "-o", "ConnectTimeout=10",
         ]
+        
+        # Use operator-provided known_hosts if available, else fail
+        known_hosts = exfil_cfg.get("ssh_known_hosts_file")
+        if known_hosts:
+            if not os.path.isfile(known_hosts):
+                raise FileNotFoundError(f"SSH known_hosts file not found: {known_hosts}")
+            ssh_opts.extend(["-o", f"UserKnownHostsFile={known_hosts}"])
+        else:
+            # Fallback: require known_hosts to prevent MITM
+            logger.error("SSH known_hosts not configured — exfil disabled for MITM protection")
+            return False
+        
         if self._ssh_key:
             ssh_opts.extend(["-i", self._ssh_key])