Archive Collected Data: Archive via Utility

Agrius used 7zip to archive extracted data in preparation for exfiltration.^[5]

Akira uses utilities such as WinRAR to archive data prior to exfiltration.^[6]

AppleSeed can zip and encrypt data collected on a target system.^[7]

APT1 has used RAR to compress files before moving them outside of the victim network.^[8]

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.^[9]

APT3 has used tools to compress data before exfilling it.^[10]

APT33 has used WinRAR to compress data prior to exfil.^[11]

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.^[12]

APT41 created a RAR archive of targeted files for exfiltration.^[13] Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.^[14]

APT41 DUST used rar to compress data downloaded from internal Oracle databases prior to exfiltration.^[15]

APT5 has used the JAR/ZIP file format for exfiltrated files.^[16]

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.^[17][18]

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.^[19][20]

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.^[21]

Calisto uses the zip -r command to compress the data collected on the local system.^[22][23]

ccf32 has used xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y to archive collected files.^[24]

certutil may be used to Base64 encode collected data.^[25][26]

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.^[27][28]

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.^[29]

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.^[30]

Crutch has used the WinRAR utility to compress and encrypt stolen files.^[31]

During Cutting Edge, threat actors saved collected data to a tar archive.^[32]

Daserf hides collected data in password-protected .rar archives.^[33]

DustySky can compress files via RAR while staging data to be exfiltrated.^[34]

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.^[35]

FIN13 has compressed the dump output of compromised credentials with a 7zip binary.^[36]

FIN8 has used RAR to compress collected data before exfiltration.^[37]

Fox Kitten has used 7-Zip to archive data.^[38]

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.^[24]

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.^[39][40]

Gallmaker has used WinZip, likely to archive data prior to exfiltration.^[41]

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.^[42][43]

IceApple can encrypt and compress files using Gzip prior to exfiltration.^[44]

iKitten will zip up the /Library/Keychains directory before exfiltrating it.^[45]

INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.^{[46][47][48][49]}

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.^[50]

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.^[51][52]

Kimsuky has used QuickZip to archive stolen files before exfiltration.^[53]

LunarWeb can create a ZIP archive with specified files and directories.^[54]

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.^[55][56][57]

menuPass has compressed files before exfiltration using TAR and RAR.^[58][59][60]

Micropsia creates a RAR archive based on collected files on the victim's machine.^[61]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.^[62]

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.^[63][64]

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.^[65]

Okrum was seen using a RAR archiver tool to compress/decompress data.^[66]

OopsIE compresses collected files with GZipStream before sending them to its C2 server.^[67]

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.^[68]

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.^[69]

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.^[70]

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.^[71]

Play has used WinRAR to compress files prior to exfiltration.^[72][73]

PoetRAT has the ability to compress files with zip.^[74]

PoshC2 contains a module for compressing data using ZIP.^[75]

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.^[76]

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.^[77]

Pupy can compress data with Zip before sending it over C2.^[78]

Ramsay can compress and archive collected files using WinRAR.^[79][80]

Rclone can compress files using gzip prior to exfiltration.^[81]

RedCurl has downloaded 7-Zip to decompress password protected archives.^[82]

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.^[83][84][85]

Sowbug extracted documents and bundled them into a RAR archive.^[86]

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.^[87]

Turian can use WinRAR to create a password-protected archive for files of interest.^[88]

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.^[89]

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.^[90][91]

WindTail has the ability to use the macOS built-in zip utility to archive files.^[92]

Wizard Spider has archived data into ZIP files on compromised machines.^[93]

System scans can be performed to identify unauthorized archival utilities.