Procedure examples

Ramsay has been delivered using OLE objects in malicious documents.

PoetRAT was delivered with documents using DDE to execute malicious code.

POWERSTATS can use DDE to execute additional payloads on compromised hosts.

BlackByte compressed data collected from victim environments prior to exfiltration.

Patchwork encrypted the collected files' path with AES and then encoded them with base64.

Dragonfly has compressed data into .zip files prior to exfiltration.

menuPass has encrypted files and information before exfiltration.

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.

The Ke3chang group has been known to compress data before exfiltration.

Leviathan has archived victim's data prior to exfiltration.

Axiom has compressed and encrypted data prior to exfiltration.

Ember Bear has compressed collected data prior to exfiltration.

LuminousMoth has manually archived stolen files from victim machines before exfiltration.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.

Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.

Exaramel for Windows automatically encrypts files before sending them to the C2 server.

JumbledPath can compress and encrypt exfiltrated packet captures from targeted devices.

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.

Lurid can compress data before sending it.

AppleSeed has compressed collected data before exfiltration.

NETWIRE has the ability to compress archived screenshots.

Aria-body has used ZIP to compress data gathered on a compromised host.

Machete stores zipped files with profile data from installed web browsers.

PowerLess can encrypt browser database files prior to exfiltration.

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.

LoFiSe can collect files into password-protected ZIP-archives for exfiltration.

VERMIN encrypts the collected files using 3-DES.

Chrommme can encrypt and store on disk collected data before exfiltration.

RunningRAT contains code to compress files.

Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

LightNeuron contains a function to encrypt and store emails that it collects.

MuddyViper has archived collected web browser data into a file named CacheDump.zip.

TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.

LP-Notes has encrypted collected credentials using AES-CBC from the CNG API and the key ED15C8344B45DAED1E0578F8BC1A32411812C61F4CB45D89B107287DE0E09FFC
and the initialization vector 91A4E6F6D51DAEE773A8F00279792578.

Spica can archive collected documents for exfiltration.

KONNI has encrypted data and files prior to exfiltration.

BLUELIGHT can zip files before exfiltration.

WellMail can archive files on the compromised host.

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Cadelspy has the ability to compress stolen data into a .cab file.

Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.

Daserf hides collected data in password-protected .rar archives.

Gold Dragon encrypts data using Base64 before being sent to the command and control server.

Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.

Proton zips up files before exfiltrating them.

Kessel can RC4-encrypt credentials before sending to the C2.

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.

Troll Stealer compresses stolen data prior to exfiltration.