Archive Collected Data: Archive via Utility

AppleSeed can zip and encrypt data collected on a target system.^[5]

APT1 has used RAR to compress files before moving them outside of the victim network.^[6]

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.^[7]

APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.^[8][9][10]

APT3 has used tools to compress data before exfilling it.^[11]

APT33 has used WinRAR to compress data prior to exfil.^[12]

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.^[13]

APT41 created a RAR archive of targeted files for exfiltration.^[14]

Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.^[15]

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.^[16][17]

Calisto uses the zip -r command to compress the data collected on the local system.^[18][19]

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.^[20][21]

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.^[22]

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.^[23]

Crutch has used the WinRAR utility to compress and encrypt stolen files.^[24]

Daserf hides collected data in password-protected .rar archives.^[25]

DustySky can compress files via RAR while staging data to be exfiltrated.^[26]

FIN8 has used RAR to compress collected data before exfiltration.^[27]

Fox Kitten has used 7-Zip to archive data.^[28]

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.^[29][30]

Gallmaker has used WinZip, likely to archive data prior to exfiltration.^[31]

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.^[32][33]

iKitten will zip up the /Library/Keychains directory before exfiltrating it.^[34]

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.^[35]

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.^[36][37]

Kimsuky has used QuickZip to archive stolen files before exfiltration.^[38]

Magic Hound has used RAR to stage and compress local folders.^[39]

menuPass has compressed files before exfiltration using TAR and RAR.^[40][41][42]

Micropsia creates a RAR archive based on collected files on the victim's machine.^[43]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.^[44]

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.^[45][46]

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.^[47]

Okrum was seen using a RAR archiver tool to compress/decompress data.^[48]

OopsIE compresses collected files with GZipStream before sending them to its C2 server.^[49]

Operation Wocao has archived collected files with WinRAR, prior to exfiltration.^[50]

PoetRAT has the ability to compress files with zip.^[51]

PoshC2 contains a module for compressing data using ZIP.^[52]

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.^[53]

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.^[54]

Pupy can compress data with Zip before sending it over C2.^[55]

Ramsay can compress and archive collected files using WinRAR.^[56][57]

Sowbug extracted documents and bundled them into a RAR archive.^[58]

Turian can use WinRAR to create a password-protected archive for files of interest.^[59]

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.^[60]

WindTail has the ability to use the macOS built-in zip utility to archive files.^[61]

System scans can be performed to identify unauthorized archival utilities.