Large Outbound Data Transfer Possible Pre-Ransomware Exfiltration

Duo Tech@duotech

•updated Jul 31, 2026•3•0•8

Detects unusually large outbound data transfers (over 500MB) that may indicate data exfiltration preceding Chaos ransomware deployment, consistent with STAC4749 incidents where data was likely stolen before encryption.