Archive Collected Data: Archive via Utility

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Many utilities exist that can archive data, including 7-Zip[1], WinRAR[2], and WinZip[3]. Most utilities include functionality to encrypt and/or compress data.

Some 3rd party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.

ID: T1560.001
Sub-technique of:  T1560
Tactic: Collection
Platforms: Linux, Windows, macOS
Data Sources: Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 20 February 2020
Last Modified: 25 March 2020

Procedure Examples

Name Description
APT1

APT1 has used RAR to compress files before moving them outside of the victim network.[18]

APT3

APT3 has used tools to compress data before exfilling it.[22]

APT33

APT33 has used WinRAR to compress data prior to exfil.[27]

APT39

APT39 has used WinRAR and 7-Zip to compress an archive stolen data. [26]

APT41

APT41 created a RAR archive of targeted files for exfiltration.[31]

BRONZE BUTLER

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.[15]

Calisto

Calisto uses the zip -r command to compress the data collected on the local system.[8][9]

CopyKittens

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.[17]

CORALDECK

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.[7]

Daserf

Daserf hides collected data in password-protected .rar archives.[10]

FIN8

FIN8 has used RAR to compress collected data before Exfiltration.[19]

Gallmaker

Gallmaker has used WinZip, likely to archive data prior to exfiltration.[28]

iKitten

iKitten will zip up the /Library/Keychains directory before exfiltrating it.[12]

InvisiMole

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.[13]

Ke3chang

Ke3chang is known to use RAR with passwords to encrypt data prior to exfiltration.[16]

Magic Hound

Magic Hound has used RAR to stage and compress local folders.[21]

menuPass

menuPass has compressed files before exfiltration using TAR and RAR.[24][25]

Micropsia

Micropsia creates a RAR archive based on collected files on the victim's machine.[11]

MuddyWater

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.[23]

OopsIE

OopsIE compresses collected files with GZipStream before sending them to its C2 server.[6]

PoshC2

PoshC2 contains a module for compressing data using ZIP.[5]

PUNCHBUGGY

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.[14]

Pupy

Pupy can compress data with Zip before sending it over C2.[4]

Soft Cell

Soft Cell used WinRAR to compress and encrypt stolen data prior to exfiltration.[30]

Sowbug

Sowbug extracted documents and bundled them into a RAR archive.[20]

Turla

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.[29]

Mitigations

Mitigation Description
Audit

System scans can be performed to identify unauthorized archival utilities.

Detection

Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities. This may yield a significant number of benign events, depending on how systems in the environment are typically used.

Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.[32]

References

  1. I. Pavlov. (2019). 7-Zip. Retrieved February 20, 2020.
  2. A. Roshal. (2020). RARLAB. Retrieved February 20, 2020.
  3. Corel Corporation. (2020). WinZip. Retrieved February 20, 2020.
  4. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  5. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  6. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  7. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  8. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  9. Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018.
  10. DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.
  11. Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.
  12. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  13. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  14. Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.
  15. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  16. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  1. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  2. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  3. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  4. Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
  5. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
  6. valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.
  7. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
  8. PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
  9. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  10. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
  11. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  12. Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.
  13. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
  14. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  15. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  16. Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.