An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.1
- Chunked Encoding
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1014 | LuminousMoth | China |
| grp_g1040 | Play | — |
| grp_g0096 | APT41 | China |
| grp_g0007 | APT28 | Russia |
| grp_g0027 | Threat Group-3390 | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.