A SOC analyst reviewing NetFlow records notices that a workstation sends small, nearly identical-sized HTTPS requests to the same external IP address every 60 seconds, day and night, with minimal response data returned. The user is not actively working during many of these intervals. Which type of malicious activity does this pattern most strongly indicate?