Procedure examples

IceApple can encrypt and compress files using Gzip prior to exfiltration.

LunarWeb can create a ZIP archive with specified files and directories.

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

certutil may be used to Base64 encode collected data.

PoshC2 contains a module for compressing data using ZIP.

Rclone can compress files using `gzip` prior to exfiltration.

Remcos can zip files and folders for upload.

Pupy can compress data with Zip before sending it over C2.

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.

Mini Shai-Hulud has compressed collected credentials and data within tar archive files prior to exfiltration.

The ZLib backdoor compresses communications using the standard Zlib compression library.

InvisiMole can use zlib to compress and decompress data.

BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.

SeaDuke compressed data with zlib prior to sending it over C2.

Epic compresses the collected data with bzip2 before sending it to the C2 server.

FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.

OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.

TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.

Cardinal RAT applies compression to C2 traffic using the ZLIB library.

FunnyDream has compressed collected files with zLib.

LunarWeb can zlib-compress data prior to exfiltration.

Denis compressed collected data using zlib.

BADFLICK has compressed data using the aPLib compression library.

Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.

HAWKBALL has encrypted data with XOR before sending it over the C2 channel.

FrameworkPOS can XOR credit card information before exfiltration.

StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.

NETWIRE has used a custom encryption algorithm to encrypt collected data.

Machete's collected data is encrypted with AES before exfiltration.

Squirrelwaffle has encrypted collected data using a XOR-based algorithm.

Agent.btz saves system information into an XML file that is then XOR-encoded.

SombRAT has encrypted collected data with AES-256 using a hardcoded key.

FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.

Okrum has used a custom implementation of AES encryption to encrypt collected data.

Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.

Reaver encrypts collected data with an incremental XOR key prior to exfiltration.

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.

T9000 encrypts collected data using a single byte XOR key.

Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.

BLUELIGHT has encoded data into a binary blob using XOR.

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.

Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.

RawPOS encodes credit card data it collected from the victim with XOR.

MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.

SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.

OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.

OSX_OCEANLOTUS.D has used AES in CBC mode to encrypt collected data when saving that data to disk.

RGDoor encrypts files with XOR before sending them back to the C2 server.

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.