T1030: Data Transfer Size Limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Security context for executives and security teams
Data Transfer Size Limits matters because exfiltration may not look like one large, obvious upload. An adversary can split data into fixed-size chunks or keep packets below alert thresholds to avoid simple volume-based monitoring. For leaders, the practical question is whether the organization can detect suspicious transfer patterns over time, not just single large transfers.
Executive priority
Prioritize this where sensitive data loss, ransomware double-extortion risk, cloud storage use, or regulated data handling are material. ATT&CK links this technique to multiple groups, campaigns, and tools, including Cobalt Strike, Rclone, StealBit, and several backdoors, so coverage should be assessed as a general exfiltration control problem rather than a niche malware signature issue. Executives should ask whether SOC metrics and audit evidence prove monitoring across Windows, Linux, macOS, and ESXi network paths, including egress points and boundary controls.
Technical view
This is an exfiltration technique for Linux, macOS, Windows, and ESXi where transfer size or packet size is intentionally constrained. MITRE provides no official detection text, but the relationship to DET0213 indicates a detection strategy exists for data transfer size limits and chunked exfiltration. SOC and detection teams should validate whether analytics look for repeated small or fixed-size outbound transfers, unusual consistency in transfer sizes, long-duration low-rate egress, and destination patterns that differ from normal business activity. Relationship context to tools such as Rclone, Cobalt Strike, Mythic, StealBit, and multiple backdoors suggests testing should include both endpoint process context and network egress behavior, without assuming any one tool is present.
Likely telemetry
- Network flow records showing byte counts, packet counts, duration, source, destination, and timing
- Proxy, firewall, secure web gateway, or network boundary logs for outbound sessions
- IDS/IPS alerts and signature hits at network boundaries
- Endpoint process execution and network connection telemetry, especially for systems initiating outbound transfers
- DNS and destination reputation/context logs to correlate repeated transfers to unusual external infrastructure
Detection direction
- Move beyond single-transfer size thresholds; validate analytics that aggregate many small transfers over time by host, user, process, destination, and protocol.
- Baseline legitimate software update, backup, replication, monitoring, and cloud sync behavior to reduce false positives from normal chunked or rate-limited transfers.
- Tune for fixed-size or highly regular transfer patterns, especially when paired with unusual destinations, rare processes, or off-hours activity.
- Correlate network observations with endpoint process lineage where possible, because network-only telemetry may show the pattern but not the responsible tool or user context.
- Check coverage gaps for Linux, macOS, Windows, and ESXi egress paths, including servers and infrastructure segments that may bypass proxy or endpoint controls.
Mitigation priorities
- Apply network intrusion prevention or detection signatures at network boundaries, consistent with ATT&CK mitigation M1031.
- Review egress control strategy so systems only reach required external destinations and services where business justified.
- Ensure boundary monitoring can aggregate low-and-slow activity over meaningful time windows rather than relying only on large-transfer alerts.
- Prioritize visibility for sensitive data repositories, servers, and systems that can reach external cloud storage or command-and-control infrastructure.
- Document monitoring, tuning rationale, and response procedures as compliance evidence for data-loss and incident-response readiness.
Additional notes and limits
The key decision value is whether the organization can see and investigate exfiltration that is deliberately shaped to avoid volume thresholds. ATT&CK relationships show this behavior is used by several campaigns, groups, and software entries, including ransomware-associated and espionage-associated contexts, but local risk depends on where sensitive data resides and which egress paths are monitored.
MITRE provides no official detection text for T1030 in the supplied object. Telemetry and detection recommendations are defensive interpretations based on the technique description, supported platforms, exfiltration tactic, DET0213 relationship, M1031 relationship, and related software/campaign/group context. Local baselines are required to distinguish malicious chunking from legitimate backup, synchronization, and application traffic.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Data Transfer Size Limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G1040: Play
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.[1][2]
G1014: LuminousMoth
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.[1][2]
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
S0264: OopsIE
S0150: POSHSPY
S0487: Kessel
S1020: Kevin
S0644: ObliqueRAT
ObliqueRAT is a remote access trojan, similar to Crimson, that has been in use by Transparent Tribe since at least 2020.[1][2]
S1200: StealBit
S0622: AppleSeed
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S0495: RDAT
S0699: Mythic
S1040: Rclone
S1141: LunarWeb
LunarWeb is a backdoor that has been used by Turla since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with LunarLoader and LunarMail. LunarWeb has only been observed deployed against servers and can use Steganography to obfuscate command and control.[1]
C0026: C0026
C0026 was a campaign identified in September 2022 that included the selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains. Several tools and tactics used during C0026 were consistent with historic Turla operations.[1]
C0015: C0015
C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 7467f364f0d8… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]CISA Play Ransomware Advisory December 2023
CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.
Open source URL - [2]Trend Micro Ransomware Spotlight Play July 2023
Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
Open source URL - [3]Bitdefender LuminousMoth July 2021
Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.
Open source URL - [4]Dell TG-3390
Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
Open source URL - [5]Unit 42 OopsIE! Feb 2018
Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
Open source URL - [6]FireEye POSHSPY April 2017
Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
Open source URL - [7]Mandiant Suspected Turla Campaign February 2023
Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
Open source URL - [8]ESET ForSSHe December 2018
Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
Open source URL - [9]Kaspersky Lyceum October 2021
Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
Open source URL - [10]Talos Oblique RAT March 2021
Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
Open source URL - [11]Cybereason StealBit Exfiltration Tool
Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
Open source URL - [12]KISA Operation Muzabi
KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.
Open source URL - [13]cobaltstrike manual
Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
Open source URL - [14]Unit42 RDAT July 2020
Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
Open source URL - [15]Mythc Documentation
Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.
Open source URL - [16]Rclone
Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.
Open source URL - [17]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [18]Cybersecurity Advisory GRU Brute Force Campaign July 2021
NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
Open source URL - [19]ESET Turla Lunar toolset May 2024
Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
Open source URL - [20]Rostovcev APT41 2021
Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.
Open source URL - [21]FireEye CARBANAK June 2017
Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
Open source URL - [22]Palo Alto OilRig May 2016
Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
- [23]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [24]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [25]University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL - [26]mitre-attackT1030Open source URL
- [27]mitre-attackT1030Open source URL
- [28]mitre-attackT1030Open source URL
- [29]CISA Play Ransomware Advisory December 2023
CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.
Open source URL - [30]Trend Micro Ransomware Spotlight Play July 2023
Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
Open source URL - [31]Bitdefender LuminousMoth July 2021
Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.
Open source URL - [32]Dell TG-3390
Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
Open source URL - [33]Unit 42 OopsIE! Feb 2018
Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
Open source URL - [34]FireEye POSHSPY April 2017
Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
Open source URL - [35]Mandiant Suspected Turla Campaign February 2023
Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
Open source URL - [36]ESET ForSSHe December 2018
Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
Open source URL - [37]Kaspersky Lyceum October 2021
Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
Open source URL - [38]Talos Oblique RAT March 2021
Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
Open source URL - [39]Cybereason StealBit Exfiltration Tool
Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
Open source URL - [40]KISA Operation Muzabi
KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.
Open source URL - [41]cobaltstrike manual
Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
Open source URL - [42]Unit42 RDAT July 2020
Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
Open source URL - [43]Mythc Documentation
Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.
Open source URL - [44]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [45]Rclone
Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.
Open source URL - [46]Cybersecurity Advisory GRU Brute Force Campaign July 2021
NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
Open source URL - [47]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [48]DFIR Conti Bazar Nov 2021
DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
Open source URL - [49]ESET Turla Lunar toolset May 2024
Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.