Description
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Platforms
Sub-Techniques (3)
Mitigations (1)
AuditM1047
System scans can be performed to identify unauthorized archival utilities.
Threat Groups (13)
| ID | Group | Context |
|---|---|---|
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) compressed data collected from victim environments prior to exfiltration.(Citation: Picus BlackByte... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) encrypted the collected files' path with AES and then encoded them with base64.(Citation: TrendMicr... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has compressed data into .zip files prior to exfiltration.(Citation: US-CERT TA18-074A) |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has encrypted files and information before exfiltration.(Citation: DOJ APT10 Dec 2018)(Citation: Dis... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s backdoor has used LZMA compression and RC4 encryption before exfiltration.(Citation: ESET OceanLotus ... |
| G0037 | FIN6 | Following data collection, [FIN6](https://attack.mitre.org/groups/G0037) has compressed log files into a ZIP archive prior to staging and exfiltration... |
| G0004 | Ke3chang | The [Ke3chang](https://attack.mitre.org/groups/G0004) group has been known to compress data before exfiltration.(Citation: Mandiant Operation Ke3chang... |
| G0065 | Leviathan | [Leviathan](https://attack.mitre.org/groups/G0065) has archived victim's data prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021) |
| G0001 | Axiom | [Axiom](https://attack.mitre.org/groups/G0001) has compressed and encrypted data prior to exfiltration.(Citation: Novetta-Axiom) |
| G1003 | Ember Bear | [Ember Bear](https://attack.mitre.org/groups/G1003) has compressed collected data prior to exfiltration.(Citation: CISA GRU29155 2024) |
| G1014 | LuminousMoth | [LuminousMoth](https://attack.mitre.org/groups/G1014) has manually archived stolen files from victim machines before exfiltration.(Citation: Bitdefend... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified direc... |
Associated Software (44)
| ID | Name | Type | Context |
|---|---|---|---|
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can compress data stolen from the Registry and volume shadow copies prior to exfiltration.(Citati... |
| S0343 | Exaramel for Windows | Malware | [Exaramel for Windows](https://attack.mitre.org/software/S0343) automatically encrypts files before sending them to the C2 server.(Citation: ESET Tele... |
| S1206 | JumbledPath | Malware | [JumbledPath](https://attack.mitre.org/software/S1206) can compress and encrypt exfiltrated packet captures from targeted devices.(Citation: Cisco Sal... |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) writes collected data to a temporary file in an encrypted form before exfiltration to a C2 ... |
| S0010 | Lurid | Malware | [Lurid](https://attack.mitre.org/software/S0010) can compress data before sending it.(Citation: Villeneuve 2011) |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has compressed collected data before exfiltration.(Citation: KISA Operation Muzabi) |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has the ability to compress archived screenshots.(Citation: Red Canary NETWIRE January 2020) |
| S0456 | Aria-body | Malware | [Aria-body](https://attack.mitre.org/software/S0456) has used ZIP to compress data gathered on a compromised host.(Citation: CheckPoint Naikon May 202... |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) stores zipped files with profile data from installed web browsers.(Citation: ESET Machete July 2019... |
| S1012 | PowerLess | Malware | [PowerLess](https://attack.mitre.org/software/S1012) can encrypt browser database files prior to exfiltration.(Citation: Cybereason PowerLess February... |
| S0113 | Prikormka | Malware | After collecting documents from removable media, [Prikormka](https://attack.mitre.org/software/S0113) compresses the collected files, and encrypts it ... |
| S1101 | LoFiSe | Malware | [LoFiSe](https://attack.mitre.org/software/S1101) can collect files into password-protected ZIP-archives for exfiltration.(Citation: Kaspersky ToddyCa... |
| S0257 | VERMIN | Malware | [VERMIN](https://attack.mitre.org/software/S0257) encrypts the collected files using 3-DES.(Citation: Unit 42 VERMIN Jan 2018) |
| S0667 | Chrommme | Malware | [Chrommme](https://attack.mitre.org/software/S0667) can encrypt and store on disk collected data before exfiltration.(Citation: ESET Gelsemium June 20... |
| S0253 | RunningRAT | Malware | [RunningRAT](https://attack.mitre.org/software/S0253) contains code to compress files.(Citation: McAfee Gold Dragon) |
| S0091 | Epic | Malware | [Epic](https://attack.mitre.org/software/S0091) encrypts collected data using a public key framework before sending it over the C2 channel.(Citation: ... |
| S0395 | LightNeuron | Malware | [LightNeuron](https://attack.mitre.org/software/S0395) contains a function to encrypt and store emails that it collects.(Citation: ESET LightNeuron Ma... |
| S9032 | MuddyViper | Malware | [MuddyViper](https://attack.mitre.org/software/S9032) has archived collected web browser data into a file named CacheDump.zip.(Citation: ESET_MuddyWat... |
| S0586 | TAINTEDSCRIBE | Malware | [TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) has used <code>FileReadZipSend</code> to compress a file and send to C2.(Citation: CISA MAR-1... |
| S9036 | LP-Notes | Malware | [LP-Notes](https://attack.mitre.org/software/S9036) has encrypted collected credentials using AES-CBC from the CNG API and the key ED15C8344B45DAED1E0... |
References
- Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.
- Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.
Frequently Asked Questions
What is T1560 (Archive Collected Data)?
T1560 is a MITRE ATT&CK technique named 'Archive Collected Data'. It belongs to the Collection tactic(s). An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the netwo...
How can T1560 be detected?
Detection of T1560 (Archive Collected Data) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1560?
There are 1 documented mitigations for T1560. Key mitigations include: Audit.
Which threat groups use T1560?
Known threat groups using T1560 include: BlackByte, Patchwork, Dragonfly, menuPass, APT32, FIN6, Ke3chang, Leviathan.