File Download via BITS

The subject leverages the Windows Background Intelligent Transfer Service (BITS) to download files from external or internal sources. BITS is a native Windows component designed for asynchronous, throttled file transfers, commonly used by the operating system and enterprise update mechanisms. Its trusted status and ability to operate in the background make it an attractive method for covert file retrieval.

Because BITS jobs can persist across reboots and operate under legitimate system processes, their misuse can blend with normal system activity, reducing visibility and delaying detection.