Description
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.
On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. Remote Data Staging).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use certutil to Base64 encode collected data before exfiltration.
Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Platforms
Mitigations (1)
AuditM1047
System scans can be performed to identify unauthorized archival utilities.
Threat Groups (39)
| ID | Group | Context |
|---|---|---|
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used WinRAR to compress and encrypt stolen data prior to exfiltration.(Citation: Cybereason Soft Cell... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has used tools to compress data before exfilling it.(Citation: aptsim) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used QuickZip to archive stolen files before exfiltration.(Citation: Talos Kimsuky Nov 2021) [Kim... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.(Cita... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) created a RAR archive of targeted files for exfiltration.(Citation: FireEye APT41 Aug 2019) Additionall... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has compressed files before exfiltration using TAR and RAR.(Citation: PWC Cloud Hopper April 2017)(C... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used 7-Zip and WinRAR to compress stolen files for exfiltration.(Citation: Microsoft HAFNIUM Marc... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to ... |
| G0084 | Gallmaker | [Gallmaker](https://attack.mitre.org/groups/G0084) has used WinZip, likely to archive data prior to exfiltration.(Citation: Symantec Gallmaker Oct 201... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has used RAR to create password-protected archives of collected documents prior to exfiltration... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used WinRAR and 7-Zip to compress an archive stolen data.(Citation: FireEye APT39 Jan 2019) |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has used Gzip and the Windows command `makecab` to compress files and stolen credentials from victim ... |
| G1024 | Akira | [Akira](https://attack.mitre.org/groups/G1024) uses utilities such as WinRAR to archive data prior to exfiltration.(Citation: Secureworks GOLD SAHARA) |
| G1041 | Sea Turtle | [Sea Turtle](https://attack.mitre.org/groups/G1041) used the tar utility to create a local archive of email data on a victim system.(Citation: Hunt Se... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) has used several publicly available tools, including WinRAR and 7zip, to compress collected fil... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.(Citation: Mandian... |
| G0006 | APT1 | [APT1](https://attack.mitre.org/groups/G0006) has used RAR to compress files before moving them outside of the victim network.(Citation: Mandiant APT1... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has encrypted files stolen from connected USB drives into a RAR file before exfiltration.(Citation: Sym... |
| G1039 | RedCurl | [RedCurl](https://attack.mitre.org/groups/G1039) has downloaded 7-Zip to decompress password protected archives.(Citation: trendmicro_redcurl) |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used WinRAR for compressing data in RAR format.(Citation: Cisco LotusBlossom 2025)(Citation... |
Associated Software (36)
| ID | Name | Type | Context |
|---|---|---|---|
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to use the macOS built-in zip utility to archive files.(Citation: objective-see wi... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has used 7zip, RAR and zip files to archive collected data for exfiltration.(Citation: ESET... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) used WinRAR rar.exe to archive files for exfiltration.(Citation: Palo Alto Unit42 STATELY TAURUS ... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can zip and encrypt data collected on a target system.(Citation: Malwarebytes Kimsuky June 2021) |
| S0278 | iKitten | Malware | [iKitten](https://attack.mitre.org/software/S0278) will zip up the /Library/Keychains directory before exfiltrating it.(Citation: objsee mac malware 2... |
| S0647 | Turian | Malware | [Turian](https://attack.mitre.org/software/S0647) can use WinRAR to create a password-protected archive for files of interest.(Citation: ESET Backdoor... |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has used utilities such as `WinRAR` to archive data prior to exfiltration.(Citation: Trend Micro MU... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) uses WinRAR to compress data that is intended to be exfiltrated.(Citation: ESET InvisiMole June ... |
| S0439 | Okrum | Malware | [Okrum](https://attack.mitre.org/software/S0439) was seen using a RAR archiver tool to compress/decompress data.(Citation: ESET Okrum July 2019) |
| S0441 | PowerShower | Malware | [PowerShower](https://attack.mitre.org/software/S0441) has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.(Citation: Kaspe... |
| S0196 | PUNCHBUGGY | Malware | [PUNCHBUGGY](https://attack.mitre.org/software/S0196) has Gzipped information and saved it to a random temp file before exfil.(Citation: Morphisec She... |
| S1246 | BeaverTail | Malware | [BeaverTail](https://attack.mitre.org/software/S1246) has collected and archived sensitive data in a zip file.(Citation: Socket BeaverTail XORIndex He... |
| S0062 | DustySky | Malware | [DustySky](https://attack.mitre.org/software/S0062) can compress files via RAR while staging data to be exfiltrated.(Citation: Kaspersky MoleRATs Apri... |
| S1210 | Sagerunex | Malware | [Sagerunex](https://attack.mitre.org/software/S1210) has archived collected materials in RAR format.(Citation: Cisco LotusBlossom 2025) |
| S9010 | GlassWorm | Malware | [GlassWorm](https://attack.mitre.org/software/S9010) has archived collected files within a zip file prior to exfiltration to include `/tmp/out.zip`.(C... |
| S0212 | CORALDECK | Malware | [CORALDECK](https://attack.mitre.org/software/S0212) has created password-protected RAR, WinImage, and zip archives to be exfiltrated.(Citation: FireE... |
| S0339 | Micropsia | Malware | [Micropsia](https://attack.mitre.org/software/S0339) creates a RAR archive based on collected files on the victim's machine.(Citation: Radware Microps... |
| S0264 | OopsIE | Malware | [OopsIE](https://attack.mitre.org/software/S0264) compresses collected files with GZipStream before sending them to its C2 server.(Citation: Unit 42 O... |
| S0538 | Crutch | Malware | [Crutch](https://attack.mitre.org/software/S0538) has used the WinRAR utility to compress and encrypt stolen files.(Citation: ESET Crutch December 202... |
| S1043 | ccf32 | Malware | [ccf32](https://attack.mitre.org/software/S1043) has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` t... |
References
- A. Roshal. (2020). RARLAB. Retrieved February 20, 2020.
- Corel Corporation. (2020). WinZip. Retrieved February 20, 2020.
- I. Pavlov. (2019). 7-Zip. Retrieved February 20, 2020.
- Living Off The Land Binaries, Scripts and Libraries (LOLBAS). (n.d.). Diantz.exe. Retrieved October 25, 2021.
- Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.
Frequently Asked Questions
What is T1560.001 (Archive via Utility)?
T1560.001 is a MITRE ATT&CK technique named 'Archive via Utility'. It belongs to the Collection tactic(s). Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that...
How can T1560.001 be detected?
Detection of T1560.001 (Archive via Utility) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1560.001?
There are 1 documented mitigations for T1560.001. Key mitigations include: Audit.
Which threat groups use T1560.001?
Known threat groups using T1560.001 include: GALLIUM, APT3, Kimsuky, Volt Typhoon, APT41, menuPass, HAFNIUM, MuddyWater.