A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stop...

A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stopped.
The files were transferred via TLS-protected HTTP sessions from systems that do not send traffic to those sites.
The technician will define this threat as: