Procedure examples

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.

APT3 has used tools to compress data before exfilling it.

Kimsuky has used QuickZip to archive stolen files before exfiltration. Kimsuky has used the Send() function to compress all collected data into a zip file named init,.zip, then renames it to init.dat, before exfiltration.

Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.

APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.

menuPass has compressed files before exfiltration using TAR and RAR.

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.

Gallmaker has used WinZip, likely to archive data prior to exfiltration.

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR `rar.exe` to archive files for exfiltration.

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.

UNC3886 has used Gzip and the Windows command `makecab` to compress files and stolen credentials from victim systems.

Akira uses utilities such as WinRAR to archive data prior to exfiltration.

Sea Turtle used the tar utility to create a local archive of email data on a victim system.

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.

APT1 has used RAR to compress files before moving them outside of the victim network.

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.

RedCurl has downloaded 7-Zip to decompress password protected archives.

Lotus Blossom has used WinRAR for compressing data in RAR format.

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.

Agrius used 7zip to archive extracted data in preparation for exfiltration.

APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.

APT5 has used the JAR/ZIP file format for exfiltrated files.

Fox Kitten has used 7-Zip to archive data.

INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.

Sowbug extracted documents and bundled them into a RAR archive.

CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.

Wizard Spider has archived data into ZIP files on compromised machines.

VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.

Play has used WinRAR to compress files prior to exfiltration.

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.

APT33 has used WinRAR to compress data prior to exfil.

FIN8 has used RAR to compress collected data before exfiltration.

FIN13 has compressed the dump output of compromised credentials with a 7zip binary.