Procedure examples

XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.

Remexi encrypts and adds all gathered browser data into files for upload to C2.

Lizar has encrypted data before sending it to the server.

Dtrack packs collected data into a password protected archive.

ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.

BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.

ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.

Empire can ZIP directories on the target system.

Mini Shai-Hulud has compressed collected credentials to reduce transmission size and to make string content harder to detect in memory forensics captures.

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.

During Cutting Edge, threat actors saved collected data to a tar archive.

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.

During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data.

During the 2025 Poland Wiper Attacks, the adversaries compressed stolen files into a zip file prior to exfiltration.

APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.

APT3 has used tools to compress data before exfilling it.

Kimsuky has used QuickZip to archive stolen files before exfiltration. Kimsuky has used the Send() function to compress all collected data into a zip file named init,.zip, then renames it to init.dat, before exfiltration.

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.

APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.

menuPass has compressed files before exfiltration using TAR and RAR.

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.

Gallmaker has used WinZip, likely to archive data prior to exfiltration.

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR `rar.exe` to archive files for exfiltration.

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.

UNC3886 has used Gzip and the Windows command `makecab` to compress files and stolen credentials from victim systems.

Akira uses utilities such as WinRAR to archive data prior to exfiltration.

Sea Turtle used the tar utility to create a local archive of email data on a victim system.

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.

APT1 has used RAR to compress files before moving them outside of the victim network.

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.

RedCurl has downloaded 7-Zip to decompress password protected archives.

Lotus Blossom has used WinRAR for compressing data in RAR format.

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.

Agrius used 7zip to archive extracted data in preparation for exfiltration.

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.

APT5 has used the JAR/ZIP file format for exfiltrated files.

Fox Kitten has used 7-Zip to archive data.

INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.