Procedure examples

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.

During Cutting Edge, threat actors saved collected data to a tar archive.

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.

During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data.

During the 2025 Poland Wiper Attacks, the adversaries compressed stolen files into a zip file prior to exfiltration.

APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.