A SOC analyst is reviewing a packet capture from an internal workstation that generated an unusually high volume of outbound DNS traffic to a single external resolver. Most queries are TXT record lookups with long, seemingly random subdomain strings such as 'a8f2k9dj3mq7.data.exfil-example.net', and responses contain large TXT payloads. CPU and disk usage on the host are normal, and no large HTTP or FTP transfers are seen. Which activity does this pattern most strongly indicate?