Attackers use the approach to look like legitimate traffic and hide data exfiltration in plain sight.
Source: Threadpost