T1027.015: Compression — MITRE ATT&CK Technique

Description

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).(Citation: Trustwave Pillowmint June 2020)

In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.(Citation: Perception Point)

File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File).(Citation: NTT Security Flagpro new December 2021) However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.(Citation: The Hacker News)

Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.

Platforms

LinuxmacOSWindows

Mitigations (1)

Antivirus/AntimalwareM1049

Anti-virus can be used to automatically detect and quarantine suspicious files. Consider anti-virus products capable of unpacking and inspecting compressed files recursively, as well as analyzing SFX archives.

Threat Groups (10)

ID	Group	Context
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has delivered malicious payloads within Zip archives.(Citation: Gen Digital Kimsuky HTTPTroy October ...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered malicious payloads within compressed archives and zip files. (Citation: VenereC...
G1018	TA2541	[TA2541](https://attack.mitre.org/groups/G1018) has used compressed and char-encoded scripts in operations.(Citation: Cisco Operation Layover Septembe...
G0126	Higaisa	[Higaisa](https://attack.mitre.org/groups/G0126) used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higai...
G0065	Leviathan	[Leviathan](https://attack.mitre.org/groups/G0065) has obfuscated code using gzip compression.(Citation: Proofpoint Leviathan Oct 2017)
G0103	Mofang	[Mofang](https://attack.mitre.org/groups/G0103) has compressed the [ShimRat](https://attack.mitre.org/software/S0444) executable within malicious emai...
G0021	Molerats	[Molerats](https://attack.mitre.org/groups/G0021) has delivered compressed executables within ZIP files to victims.(Citation: Kaspersky MoleRATs April...
G1055	VOID MANTICORE	[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has compressed their payloads by leveraging zip files.(Citation: FBI IC3 Flash VOID MANTICORE ...
G0090	WIRTE	[WIRTE](https://attack.mitre.org/groups/G0090) has compressed malicious files within RAR and ZIP archives for obfuscation. (Citation: Check Point Wir...
G0027	Threat Group-3390	[Threat Group-3390](https://attack.mitre.org/groups/G0027) malware is compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(C...

Associated Software (25)

ID	Name	Type	Context
S1100	Ninja	Malware	[Ninja](https://attack.mitre.org/software/S1100) has compressed its data with the LZSS algorithm.(Citation: Kaspersky ToddyCat June 2022)(Citation: Ka...
S0662	RCSession	Malware	[RCSession](https://attack.mitre.org/software/S0662) can compress and obfuscate its strings to evade detection on a compromised host.(Citation: Trend ...
S0466	WindTail	Malware	[WindTail](https://attack.mitre.org/software/S0466) can be delivered as a compressed, encrypted, and encoded payload.(Citation: objective-see windtail...
S0665	ThreatNeedle	Malware	[ThreatNeedle](https://attack.mitre.org/software/S0665) has been compressed and obfuscated.(Citation: Kaspersky ThreatNeedle Feb 2021)
S0453	Pony	Malware	[Pony](https://attack.mitre.org/software/S0453) attachments have been delivered via compressed archive files.(Citation: Malwarebytes Pony April 2016)
S1081	BADHATCH	Malware	[BADHATCH](https://attack.mitre.org/software/S1081) can be compressed with the ApLib algorithm.(Citation: BitDefender BADHATCH Mar 2021)
S1228	PUBLOAD	Malware	[PUBLOAD](https://attack.mitre.org/software/S1228) has been delivered as compressed files within ZIP files to victims.(Citation: Lab52 MUSTANG PANDA P...
S0444	ShimRat	Malware	[ShimRat](https://attack.mitre.org/software/S0444) has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat f...
S1124	SocGholish	Malware	The [SocGholish](https://attack.mitre.org/software/S1124) JavaScript payload has been delivered within a compressed ZIP archive.(Citation: Red Canary ...
S1188	Line Runner	Malware	[Line Runner](https://attack.mitre.org/software/S1188) uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed fo...
S0673	DarkWatchman	Malware	[DarkWatchman](https://attack.mitre.org/software/S0673) has been delivered as compressed RAR payloads in ZIP files to victims.(Citation: Prevailion Da...
S9020	LODEINFO	Malware	[LODEINFO](https://attack.mitre.org/software/S9020) components have been compressed with zip for delivery.(Citation: Kaspersky LODEINFO OCT 2022)
S0585	Kerrdown	Malware	[Kerrdown](https://attack.mitre.org/software/S0585) can encrypt, encode, and compress multiple layers of shellcode.(Citation: Unit 42 KerrDown Februar...
S0148	RTM	Malware	[RTM](https://attack.mitre.org/software/S0148) has been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.(Citation: ESET R...
S1183	StrelaStealer	Malware	[StrelaStealer](https://attack.mitre.org/software/S1183) has been delivered via JScript files in a ZIP archive.(Citation: PaloAlto StrelaStealer 2024)...
S0697	HermeticWiper	Malware	[HermeticWiper](https://attack.mitre.org/software/S0697) can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.(Citation: Symantec...
S0664	Pandora	Malware	[Pandora](https://attack.mitre.org/software/S0664) has the ability to compress stings with QuickLZ.(Citation: Trend Micro Iron Tiger April 2021)
S0559	SUNBURST	Malware	[SUNBURST](https://attack.mitre.org/software/S0559) strings were compressed and encoded in Base64.(Citation: Microsoft Analyzing Solorigate Dec 2020)
S1099	Samurai	Malware	[Samurai](https://attack.mitre.org/software/S1099) can deliver its final payload as a compressed, encrypted and base64-encoded blob.(Citation: Kaspers...
S0517	Pillowmint	Malware	[Pillowmint](https://attack.mitre.org/software/S0517) has been compressed and stored within a registry key.(Citation: Trustwave Pillowmint June 2020)

References

Frequently Asked Questions

What is T1027.015 (Compression)?

T1027.015 is a MITRE ATT&CK technique named 'Compression'. It belongs to the Stealth tactic(s). Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and fast...

How can T1027.015 be detected?

Detection of T1027.015 (Compression) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1027.015?

There are 1 documented mitigations for T1027.015. Key mitigations include: Antivirus/Antimalware.

Which threat groups use T1027.015?

Known threat groups using T1027.015 include: Kimsuky, Gamaredon Group, TA2541, Higaisa, Leviathan, Mofang, Molerats, VOID MANTICORE.