Archive Collected Data: Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.

On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging).[1] xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.

Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.[2][3][4]

ID: T1560.001
Sub-technique of:  T1560
Tactic: Collection
Platforms: Linux, Windows, macOS
Contributors: Mark Wee; Mayan Arora aka Mayan Mohan
Version: 1.3
Created: 20 February 2020
Last Modified: 15 September 2023

Procedure Examples

ID Name Description
S0622 AppleSeed

AppleSeed can zip and encrypt data collected on a target system.[5]

G0006 APT1

APT1 has used RAR to compress files before moving them outside of the victim network.[6]

G0007 APT28

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.[7]

G0022 APT3

APT3 has used tools to compress data before exfilling it.[8]

G0064 APT33

APT33 has used WinRAR to compress data prior to exfil.[9]

G0087 APT39

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.[10]

G0096 APT41

APT41 created a RAR archive of targeted files for exfiltration.[11]

G0143 Aquatic Panda

Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.[12]

G0060 BRONZE BUTLER

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.[13][14]

C0026 C0026

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.[15]

S0274 Calisto

Calisto uses the zip -r command to compress the data collected on the local system.[16][17]

S1043 ccf32

ccf32 has used xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y to archive collected files.[18]

S0160 certutil

certutil may be used to Base64 encode collected data.[19][20]

G0114 Chimera

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.[21][22]

G0052 CopyKittens

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.[23]

S0212 CORALDECK

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.[24]

S0538 Crutch

Crutch has used the WinRAR utility to compress and encrypt stolen files.[25]

S0187 Daserf

Daserf hides collected data in password-protected .rar archives.[26]

S0062 DustySky

DustySky can compress files via RAR while staging data to be exfiltrated.[27]

G1006 Earth Lusca

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.[28]

G1016 FIN13

FIN13 has compressed the dump output of compromised credentials with a 7zip binary.[29]

G0061 FIN8

FIN8 has used RAR to compress collected data before exfiltration.[30]

G0117 Fox Kitten

Fox Kitten has used 7-Zip to archive data.[31]

C0007 FunnyDream

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.[18]

G0093 GALLIUM

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.[32][33]

G0084 Gallmaker

Gallmaker has used WinZip, likely to archive data prior to exfiltration.[34]

G0125 HAFNIUM

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.[35][36]

S1022 IceApple

IceApple can encrypt and compress files using Gzip prior to exfiltration.[37]

S0278 iKitten

iKitten will zip up the /Library/Keychains directory before exfiltrating it.[38]

S0260 InvisiMole

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.[39]

G0004 Ke3chang

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.[40][41]

G0094 Kimsuky

Kimsuky has used QuickZip to archive stolen files before exfiltration.[42]

G0059 Magic Hound

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.[43][44][45]

G0045 menuPass

menuPass has compressed files before exfiltration using TAR and RAR.[46][47][48]

S0339 Micropsia

Micropsia creates a RAR archive based on collected files on the victim's machine.[49]

G0069 MuddyWater

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.[50]

G0129 Mustang Panda

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.[51][52]

S0340 Octopus

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.[53]

S0439 Okrum

Okrum was seen using a RAR archiver tool to compress/decompress data.[54]

S0264 OopsIE

OopsIE compresses collected files with GZipStream before sending them to its C2 server.[55]

C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.[56]

C0022 Operation Dream Job

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.[57]

C0006 Operation Honeybee

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.[58]

C0014 Operation Wocao

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.[59]

S0428 PoetRAT

PoetRAT has the ability to compress files with zip.[60]

S0378 PoshC2

PoshC2 contains a module for compressing data using ZIP.[61]

S0441 PowerShower

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.[62]

S0196 PUNCHBUGGY

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.[63]

S0192 Pupy

Pupy can compress data with Zip before sending it over C2.[64]

S0458 Ramsay

Ramsay can compress and archive collected files using WinRAR.[65][66]

S1040 Rclone

Rclone can compress files using gzip prior to exfiltration.[67]

C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.[68][69][70]

G0054 Sowbug

Sowbug extracted documents and bundled them into a RAR archive.[71]

S0647 Turian

Turian can use WinRAR to create a password-protected archive for files of interest.[72]

G0010 Turla

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.[73]

G1017 Volt Typhoon

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.[74]

S0466 WindTail

WindTail has the ability to use the macOS built-in zip utility to archive files.[75]

G0102 Wizard Spider

Wizard Spider has archived data into ZIP files on compromised machines.[76]

Mitigations

ID Mitigation Description
M1047 Audit

System scans can be performed to identify unauthorized archival utilities.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that will aid in compression or encrypting data that is collected prior to exfiltration, such as tar.

DS0022 File File Creation

Monitor newly constructed files being written with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.

DS0009 Process Process Creation

Monitor for newly constructed processes and/or command-lines that aid in compression or encrypting data that is collected prior to exfiltration, such as 7-Zip, WinRAR, and WinZip. Before Exfiltration that an adversary has Collection, it is very likely that a Archive Collected Data will be created, so that transfer times are minimized and fewer files are transmitted. There is variety between the tools used to compress data, but the command line usage and context of archiving tools, such as ZIP, RAR, and 7ZIP, should be monitored.In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of "* a *". This is helpful, as adversaries may change program names.

Note: This analytic looks for the command line argument a, which is used by RAR. However, there may be other programs that have this as a legitimate argument and may need to be filtered out.

Analytic 1 - Command Line Usage of Archiving Software

rar_argument = filter processes where (command_line == " a ")

References

  1. Living Off The Land Binaries, Scripts and Libraries (LOLBAS). (n.d.). Diantz.exe. Retrieved October 25, 2021.
  2. I. Pavlov. (2019). 7-Zip. Retrieved February 20, 2020.
  3. A. Roshal. (2020). RARLAB. Retrieved February 20, 2020.
  4. Corel Corporation. (2020). WinZip. Retrieved February 20, 2020.
  5. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  6. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  7. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
  8. valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.
  9. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  10. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
  11. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  12. Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.
  13. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  14. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  15. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
  16. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  17. Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018.
  18. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  19. Microsoft. (2012, November 14). Certutil. Retrieved July 3, 2017.
  20. LOLBAS. (n.d.). Certutil.exe. Retrieved July 31, 2019.
  21. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.
  22. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  23. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  24. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  25. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
  26. DiMaggio, J. (2016, April 28). Tick cyberespionage group zeros in on Japan. Retrieved July 16, 2018.
  27. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  28. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  29. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
  30. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  31. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
  32. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  33. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
  34. Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.
  35. MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.
  36. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.
  37. CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.
  38. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  1. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  2. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  3. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
  4. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  5. Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.
  6. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.
  7. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
  8. PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
  9. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  10. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
  11. Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.
  12. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
  13. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.
  14. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
  15. Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.
  16. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
  17. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  18. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  19. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.
  20. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  21. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  22. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
  23. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  24. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  25. Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.
  26. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  27. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  28. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  29. Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.
  30. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  31. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  32. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  33. Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
  34. Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021
  35. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
  36. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
  37. Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
  38. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.