Archive Collected Data

ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.^[10]

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.^[13]

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.^[31]

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.^[34]

Aria-body has used ZIP to compress data gathered on a compromised host.^[24]

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.^[12]

Cadelspy has the ability to compress stolen data into a .cab file.^[23]

Daserf hides collected data in password-protected .rar archives.^[4]

Dragonfly 2.0 compressed data into .zip files prior to exfiltrating it.^[33]

Emotet has been observed encrypting the data it collects before sending it to the C2 server. ^[18]

Empire can ZIP directories on the target system.^[1]

Epic encrypts collected data using a public key framework before sending it over the C2 channel.^[15] Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.^[16]

Exaramel for Windows automatically encrypts files before sending them to the C2 server.^[21]

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.^[17]

Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.^[27]

Gold Dragon encrypts data using Base64 before being sent to the command and control server.^[3]

Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.^[26]

The Ke3chang group has been known to compress data before exfiltration.^[32]

Lazarus Group malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server. ^[28][29][30]

LightNeuron contains a function to encrypt and store emails that it collects.^[20]

Lurid can compress data before sending it.^[11]

Machete stores zipped files with profile data from installed web browsers.^[22]

menuPass has encrypted files and information before exfiltration.^[35]

OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.^[14]

Patchwork encrypted the collected files' path with AES and then encoded them with base64.^[25]

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.^[5]

Proton zips up files before exfiltrating them.^[9]

Remexi encrypts and adds all gathered browser data into files for upload to C2.^[19]

RunningRAT contains code to compress files.^[3]

ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.^[2]

VERMIN encrypts the collected files using 3-DES.^[6]

Zebrocy uses an encryption method similar to RC4 as well as AES to encrypt data before exfiltration. ^[7][8]

System scans can be performed to identify unauthorized archival utilities.