Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm.
| ID | Name | Description |
|---|---|---|
| S0422 | Anubis |
Anubis exfiltrates data encrypted (with RC4) by its ransomware module.[1] |
| S0540 | Asacub |
Asacub has encrypted C2 communications using Base64-encoded RC4.[2] |
| S1079 | BOULDSPY | |
| S1094 | BRATA |
BRATA has compressed data with the |
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to exfiltrate encrypted data to the C2 server.[5] |
| S1243 | DCHSpy |
DCHSpy has compressed and encrypted collected data with a password from the C2 server.[6] |
| S0505 | Desert Scorpion |
Desert Scorpion can encrypt exfiltrated data.[7] |
| S0405 | Exodus |
Exodus One encrypts data using XOR prior to exfiltration.[8] |
| S0577 | FrozenCell |
FrozenCell has compressed and encrypted data before exfiltration using password protected .7z archives.[9] |
| S0535 | Golden Cup |
Golden Cup has encrypted exfiltrated data using AES in ECB mode.[10] |
| S0421 | GolfSpy |
GolfSpy encrypts data using a simple XOR operation with a pre-configured key prior to exfiltration.[11] |
| S1185 | LightSpy |
LightSpy collects and compresses data to be exfiltrated using SSZipArchive.[12][13] |
| S1082 | Sunbird | |
| S0424 | Triada |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0670 | Detection of Archive Collected Data | AN1767 |
The defender correlates recent access to locally collected or protected data with subsequent compression, packaging, or encryption behavior inside the same app context, followed by creation of archive-like or high-entropy output and optional near-term network transmission. The analytic prioritizes Android runtime and storage effects: application data access or sensor-derived collection, compression/encryption framework use, archive/blob creation in app-accessible storage, and background or device-locked execution inconsistent with the app’s declared function. |
| AN1768 |
The defender correlates managed-app data access and lifecycle context with indirect evidence of packaging or encryption prior to outbound transfer. Because direct archive/compression visibility is generally weaker on iOS, the analytic anchors on app lifecycle state, file/output effects observable by mobile EDR where available, managed app role via MDM, and downstream network uploads that closely follow creation of new large or high-entropy local artifacts. Confidence is lower when only network effects are available. |