Data Transfer Size Limits

APT28 has split archived exfiltration files into chunks smaller than 1MB.

APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.

LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.

Play has split victims' files into chunks for exfiltration.

Threat Group-3390 actors have split RAR files for exfiltration into parts.

AppleSeed has divided files if the size is 0x1000000 bytes or more.

Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .

Cobalt Strike will break large data sets into smaller chunks for exfiltration.

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.

Kevin can exfiltrate data to the C2 server in 27-character chunks.

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.

Mythic supports custom chunk sizes used to upload/download files.

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.

During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.