H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

22 recorded

Relationships

mitigates

from Network Intrusion Prevention

Mitigation

uses

from AppleSeed

Malware

uses

from APT28

Group

uses

from APT41

Group

uses

from C0015

Campaign

uses

from C0026

Campaign

uses

from Carbanak

Malware

uses

from Cobalt Strike

Malware

uses

from Helminth

Malware

uses

from Kessel

Malware

uses

from Kevin

Malware

uses

from LuminousMoth

Group

uses

from LunarWeb

Malware

uses

from Mythic

Tool

uses

from ObliqueRAT

Malware

uses

from OopsIE

Malware

uses

from Play

Group

uses

from POSHSPY

Malware

uses

from Rclone

Tool

uses

from RDAT

Malware

uses

from StealBit

Malware

uses

from Threat Group-3390

Group

2 external

References

mitre-attack

T1030

open

University of Birmingham C2

https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf

open