Archive Collected Data: Archive via Utility

Agrius used 7zip to archive extracted data in preparation for exfiltration.^[5]

Akira uses utilities such as WinRAR to archive data prior to exfiltration.^[6]

AppleSeed can zip and encrypt data collected on a target system.^[7]

APT1 has used RAR to compress files before moving them outside of the victim network.^[8]

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.^[9]

During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data.^[10]

APT3 has used tools to compress data before exfilling it.^[11]

APT33 has used WinRAR to compress data prior to exfil.^[12]

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.^[13]

APT41 created a RAR archive of targeted files for exfiltration.^[14] Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.^[15]

APT41 DUST used rar to compress data downloaded from internal Oracle databases prior to exfiltration.^[16]

APT5 has used the JAR/ZIP file format for exfiltrated files.^[17]

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.^[18][19]

BeaverTail has collected and archived sensitive data in a zip file.^[20]

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.^[21][22]

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.^[23]

Calisto uses the zip -r command to compress the data collected on the local system.^[24][25]

ccf32 has used xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y to archive collected files.^[26]

certutil may be used to Base64 encode collected data.^[27][28]

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.^[29][30]

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.^[31]

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.^[32]

Crutch has used the WinRAR utility to compress and encrypt stolen files.^[33]

During Cutting Edge, threat actors saved collected data to a tar archive.^[34]

Daserf hides collected data in password-protected .rar archives.^[35]

DustySky can compress files via RAR while staging data to be exfiltrated.^[36]

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.^[37]

FIN13 has compressed the dump output of compromised credentials with a 7zip binary.^[38]

FIN8 has used RAR to compress collected data before exfiltration.^[39]

Fox Kitten has used 7-Zip to archive data.^[40]

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.^[26]

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.^[41][42]

Gallmaker has used WinZip, likely to archive data prior to exfiltration.^[43]

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.^[44][45]

IceApple can encrypt and compress files using Gzip prior to exfiltration.^[46]

iKitten will zip up the /Library/Keychains directory before exfiltrating it.^[47]

INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.^{[48][49][50][51]}

InvisibleFerret has used 7zip, RAR and zip files to archive collected data for exfiltration.^[52][53]

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.^[54]

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.^[55][56]

Kimsuky has used QuickZip to archive stolen files before exfiltration.^[57]

Lotus Blossom has used WinRAR for compressing data in RAR format.^[58][59]

LunarWeb can create a ZIP archive with specified files and directories.^[60]

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.^[61][62][63]

menuPass has compressed files before exfiltration using TAR and RAR.^[64][65][66]

Micropsia creates a RAR archive based on collected files on the victim's machine.^[67]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.^[68]

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.^[69][70] Mustang Panda has used WinRAR "Rar.exe" to archive stolen files before exfiltration.^[71] Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR rar.exe to archive files for exfiltration.^[72]

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.^[73]

Okrum was seen using a RAR archiver tool to compress/decompress data.^[74]

OopsIE compresses collected files with GZipStream before sending them to its C2 server.^[75]

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.^[76]

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.^[77]

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.^[78]

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.^[79]

Play has used WinRAR to compress files prior to exfiltration.^[80][81]

PoetRAT has the ability to compress files with zip.^[82]

PoshC2 contains a module for compressing data using ZIP.^[83]

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.^[84]

PUBLOAD has used utilities such as WinRAR to archive data prior to exfiltration.^[85]

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.^[86]

Pupy can compress data with Zip before sending it over C2.^[87]

Ramsay can compress and archive collected files using WinRAR.^[88][89]

Rclone can compress files using gzip prior to exfiltration.^[90]

RedCurl has downloaded 7-Zip to decompress password protected archives.^[91]

Sagerunex has archived collected materials in RAR format.^[58]

SampleCheck5000 can gzip compress files uploaded to a shared mailbox used for C2 and exfiltration.^[92]

Sea Turtle used the tar utility to create a local archive of email data on a victim system.^[93]

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.^[94][95][96]

Sowbug extracted documents and bundled them into a RAR archive.^[97]

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.^[98]

TONESHELL used WinRAR rar.exe to archive files for exfiltration.^[72][71] TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.^[71]

Turian can use WinRAR to create a password-protected archive for files of interest.^[99]

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.^[100]

UNC3886 has used Gzip and the Windows command makecab to compress files and stolen credentials from victim systems.^[101][102]

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.^[103][104]

WindTail has the ability to use the macOS built-in zip utility to archive files.^[105]

Wizard Spider has archived data into ZIP files on compromised machines.^[106]

System scans can be performed to identify unauthorized archival utilities.