Procedure examples

BlackByte compressed data collected from victim environments prior to exfiltration.

Patchwork encrypted the collected files' path with AES and then encoded them with base64.

Dragonfly has compressed data into .zip files prior to exfiltration.

menuPass has encrypted files and information before exfiltration.

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.

The Ke3chang group has been known to compress data before exfiltration.

Leviathan has archived victim's data prior to exfiltration.

Axiom has compressed and encrypted data prior to exfiltration.

Ember Bear has compressed collected data prior to exfiltration.

LuminousMoth has manually archived stolen files from victim machines before exfiltration.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.