Archive Collected Data: Archive via Utility

APT1 has used RAR to compress files before moving them outside of the victim network.^[25]

APT3 has used tools to compress data before exfilling it.^[29]

APT33 has used WinRAR to compress data prior to exfil.^[34]

APT39 has used WinRAR and 7-Zip to compress an archive stolen data. ^[33]

APT41 created a RAR archive of targeted files for exfiltration.^[38]

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.^[21][22]

Calisto uses the zip -r command to compress the data collected on the local system.^[8][9]

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.^[24]

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.^[7]

Daserf hides collected data in password-protected .rar archives.^[10]

DustySky can compress files via RAR while staging data to be exfiltrated.^[18]

FIN8 has used RAR to compress collected data before Exfiltration.^[26]

Gallmaker has used WinZip, likely to archive data prior to exfiltration.^[35]

iKitten will zip up the /Library/Keychains directory before exfiltrating it.^[12]

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.^[13]

Ke3chang is known to use RAR with passwords to encrypt data prior to exfiltration.^[23]

Magic Hound has used RAR to stage and compress local folders.^[28]

menuPass has compressed files before exfiltration using TAR and RAR.^[31][32]

Micropsia creates a RAR archive based on collected files on the victim's machine.^[11]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.^[30]

Okrum was seen using a RAR archiver tool to compress/decompress data.^[16]

OopsIE compresses collected files with GZipStream before sending them to its C2 server.^[6]

PoetRAT has the ability to compress files with zip.^[15]

PoshC2 contains a module for compressing data using ZIP.^[5]

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.^[17]

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.^[14]

Pupy can compress data with Zip before sending it over C2.^[4]

Ramsay can compress and archive collected files using WinRAR.^[19]

Soft Cell used WinRAR to compress and encrypt stolen data prior to exfiltration.^[37]

Sowbug extracted documents and bundled them into a RAR archive.^[27]

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.^[36]

WindTail has the ability to use the macOS built-in zip utility to archive files.^[20]

System scans can be performed to identify unauthorized archival utilities.