Procedure examples

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.

Sowbug extracted documents and bundled them into a RAR archive.

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.

Wizard Spider has archived data into ZIP files on compromised machines.

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.

Play has used WinRAR to compress files prior to exfiltration.

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.

APT33 has used WinRAR to compress data prior to exfil.

FIN8 has used RAR to compress collected data before exfiltration.

FIN13 has compressed the dump output of compromised credentials with a 7zip binary.

WindTail has the ability to use the macOS built-in zip utility to archive files.

InvisibleFerret has used 7zip, RAR and zip files to archive collected data for exfiltration.

TONESHELL used WinRAR rar.exe to archive files for exfiltration. TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.

AppleSeed can zip and encrypt data collected on a target system.

iKitten will zip up the /Library/Keychains directory before exfiltrating it.

Turian can use WinRAR to create a password-protected archive for files of interest.

PUBLOAD has used utilities such as `WinRAR` to archive data prior to exfiltration.

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

Okrum was seen using a RAR archiver tool to compress/decompress data.

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.

BeaverTail has collected and archived sensitive data in a zip file.

DustySky can compress files via RAR while staging data to be exfiltrated.

Sagerunex has archived collected materials in RAR format.

GlassWorm has archived collected files within a zip file prior to exfiltration to include `/tmp/out.zip`.

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.

Micropsia creates a RAR archive based on collected files on the victim's machine.

OopsIE compresses collected files with GZipStream before sending them to its C2 server.

Crutch has used the WinRAR utility to compress and encrypt stolen files.

ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.

SampleCheck5000 can gzip compress files uploaded to a shared mailbox used for C2 and exfiltration.

Daserf hides collected data in password-protected .rar archives.

Calisto uses the zip -r command to compress the data collected on the local system.

Ramsay can compress and archive collected files using WinRAR.

LAMEHUG can xcopy for file collection on targeted systems.

PoetRAT has the ability to compress files with zip.

IceApple can encrypt and compress files using Gzip prior to exfiltration.

LunarWeb can create a ZIP archive with specified files and directories.

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

certutil may be used to Base64 encode collected data.

PoshC2 contains a module for compressing data using ZIP.

Rclone can compress files using `gzip` prior to exfiltration.

Remcos can zip files and folders for upload.

Pupy can compress data with Zip before sending it over C2.

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.

Mini Shai-Hulud has compressed collected credentials and data within tar archive files prior to exfiltration.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.

The ZLib backdoor compresses communications using the standard Zlib compression library.

InvisiMole can use zlib to compress and decompress data.