Activity timeline
T1030 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-06 with 6 reports, and 20 of the 20 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1030 Data Transfer Size Limits is catalogued by MITRE ATT&CK under the Exfiltration tactic in the Enterprise matrix. Threadlinqs maps 20 of 2623 tracked threats (0.8%) to it; by severity that is 6 critical, 9 high, 5 medium.
Threats that use T1030 most often also use T1005 Data from Local System (16 threats), T1027 Obfuscated Files or Information (12 threats), T1036.005 Match Legitimate Resource Name or Location (11 threats), T1041 Exfiltration Over C2 Channel (11 threats), T1082 System Information Discovery (11 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
16 tracked threat actors appear in the threats that use T1030; the most frequent are APT38 (1), APT44 (1), BlackSuit affiliate (1), Cavern Manticore (1), ClickLock Dev (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1030.
Data sources
Telemetry that can reveal T1030, per MITRE ATT&CK.
- Network Traffic — Network Connection Creation, Network Traffic Flow
Threat actors using it
Tracked threats
20 tracked threats use T1030.
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting…high
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
- ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoorhigh
- AI-"Vibe-Coded" PowerShell Script ("Untitled1.ps1") Used for Active Directory Enumeration and S3…medium
- Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via…high
- Aquatic Panda (Earth Lusca) APT - Log4Shell Exploitation and Multi-Platform Backdoor Campaigns Targeting 17…critical
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS…high
- Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromisedcritical
- Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packagescritical
- ServiceNow Scripted REST Resource Unauthenticated Access - /api/now/related_list_edit/createcritical
- Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries…high
- Nimbus RAT: Java-based Remote Access Trojan Delivered via Microsoft Teams Vishing, Quick Assist, and Google…high
- SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme…high
- GemStuffer Campaign — RubyGems Registry Abused as Exfiltration Channel for UK Local Government Datahigh
- PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182…critical
- GRIDTIDE Backdoor — PRC-Nexus UNC2814 Global Telecom & Government Espionage via Google Sheets C2critical
- State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database…high
Detection coverage
Threadlinqs maintains 23 detection rules mapped to T1030 (SPL 10, KQL 6, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.