#T1560 Archive Collected Data

Technique

  • Tactics: Collection
  • Description:

    An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

    Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

  • First Seen: Lazarus Group • 2017-05-31
MITRE ATT&CK

Tagged Reports

2026-05-28
Levelblue
#SapphireSleet #Bluenoroff #UNC1069 #macOS #Cryptocurrency #Phishing #T1059.002 #T1059.004 #T1105 #T1005 #T1560 #T1041 #T1543.004
2026-04-21
Any Run
#ClickFix #Lazarus #macOS #T1005 #T1543.001 #T1083 #T1497 #T1548.003 #T1555 #T1560 #T1124 #T1222 #T1567 #T1204 #T1552 #T1057 #T1082
2026-03-10
Cyble
#Wagemole #T1005 #T1059.006 #T1059.007 #T1083 #T1041 #T1560 #T1195 #T1027 #T1204.002 #T1555.003 #T1566.003 #T1071.001 #T1082
2026-02-03
Red Asgard
#ContagiousInterview #Lazarus #T1566.003 #T1552.001 #T1114 #T1027.002 #T1573.001 #T1098 #T1547.001 #T1530 #T1496 #T1005 #T1053.005 #T1113 #T1219 #T1560 #T1204.002 #T1102.001 #T1071.001 #T1087 #T1573.002 #T1555.003 #T1056.001 #T1497.001
2025-08-13
Cyfirma
#Lazarus #T1090.001 #T1134.002 #T1562.001 #T1543.003 #T1059.003 #T1553.002 #T1614.001 #T1074.001 #T1485 #T1591 #T1218.011 #T1620 #T1078 #T1587.001 #T1027.007 #T1010 #T1571 #T1090.002 #T1218.010 #T1542.003 #T1583.001 #T1033 #T1497.001 #T1560.002 #T1203 #T1036 #T1012 #T1016 #T1059.005 #T1106 #T1027 #T1566.003 #T1027.002 #T1562.004 #T1529 #T1049 #T1140 #T1585.001 #T1005 #T1053.005 #T1564.001 #T1608.001 #T1105 #T1046 #T1491.001 #T1055.001 #T1070 #T1589.002 #T1036.005 #T1110 #T1547.009 #T1489 #T1110.003 #T1534 #T1047 #T1573 #T1588.004 #T1104 #T1036.003 #T1591.004 #T1001.003 #T1057 #T1082 #T1561.002 #T1566.001 #T1574.013 #T1561.001 #T1608.002 #T1585.002 #T1218 #T1588.002 #T1036.004 #T1204.001 #T1041 #T1560 #T1202 #T1071.001 #T1218.005 #T1059.001 #T1593.001 #T1189 #T1124 #T1056.001 #T1070.006 #T1008 #T1102.002 #T1048.003 #T1583.006 #T1221 #T1557.001 #T1098 #T1547.001 #T1567.002 #T1584.004 #T1087.002 #T1070.004 #T1560.003 #T1070.003 #T1583.004 #T1132.001 #T1588.003 #T1021.002 #T1204.002 #T1220 #T1574.002 #T1083 #T1566.002 #T1021.001 #T1021.004 #T1584.001
2024-12-27
Picus Security
#Kimsuky #RandomQuery #GoldDragon #xRAT #T1055 #T1114.003 #T1082 #T1566.001 #T1059.001 #T1074.001 #T1219 #T1560 #T1059.005 #T1059.004 #T1027 #T1056.001 #T1573.001 #T1048 #T1547.001 #T1562.004 #T1071.001 #T1003
2024-11-06
David_Jou
#APT37 #CVE-2024-38178 #VeilShell #T1069 #T1027 #T1071 #T1057 #T1082 #T1574 #T1566 #T1140 #T1030 #T1041 #T1555 #T1560 #T1132 #T1055 #T1547 #T1070 #T1112 #T1053 #T1033 #T1204 #T1059 #T1003
2024-10-03
Securonix
#APT37 #VeilShell #ShroudedSleep #T1069 #T1027 #T1057 #T1082 #T1566.001 #T1547.001 #T1204.001 #T1059.007 #T1070.004 #T1041 #T1560 #T1555 #T1204.002 #T1132 #T1112 #T1059.001 #T1053 #T1033 #T1574.014 #T1003
2024-07-31
Securonix
#DevPopper #NPM #T1059.006 #T1070.004 #T1082 #T1027.010 #T1059.003 #T1041 #T1059.001 #T1560 #T1033 #T1132
2024-07-25
USCISA
#YARA #Andariel #T1190 #T1027 #T1595 #T1048 #T1592 #T1567 #T1071 #T1572 #T1591 #T1090 #T1021 #T1587.001 #T1560 #T1021.002 #T1039 #T1587.004 #T1087 #T1083 #T1040 #T1059 #T1596 #T1003
2024-07-19
Cyfirma
#Trend #Andariel #Kimsuky #MoonstoneSleet #Lazarus #T1562.001 #T1190 #T1068 #T1543.003 #T1056 #T1595.002 #T1059.003 #T1566 #T1485 #T1218.011 #T1069.002 #T1010 #T1571 #T1102.001 #T1583.001 #T1555.003 #T1033 #T1497.001 #T1203 #T1036 #T1012 #T1027 #T1583.003 #T1071 #T1562.004 #T1614 #T1027.005 #T1548 #T1552 #T1140 #T1005 #T1053.005 #T1564.001 #T1555 #T1129 #T1070.001 #T1046 #T1070 #T1095 #T1569.002 #T1562 #T1573 #T1047 #T1552.001 #T1057 #T1082 #T1518.001 #T1176 #T1090 #T1518 #T1539 #T1041 #T1564 #T1560 #T1202 #T1071.001 #T1547 #T1112 #T1497 #T1059.001 #T1124 #T1056.001 #T1222 #T1070.006 #T1059 #T1564.003 #T1222.001 #T1056.004 #T1547.001 #T1584 #T1087.002 #T1070.004 #T1505.003 #T1113 #T1608.005 #T1204.002 #T1087 #T1574.002 #T1115 #T1083 #T1490 #T1053 #T1486 #T1566.002 #T1133 #T1021.004 #T1003
2024-05-21
Securonix
#Phishing #T1059.001 #T1059.003 #T1027.010 #T1070.004 #T1082 #T1041 #T1560 #T1547.001 #T1555.003 #CloudReverser
2024-04-25
Securonix
#NPM #DevPopper #T1059.006 #T1070.004 #T1082 #T1027.010 #T1059.003 #T1041 #T1059.001 #T1560 #T1033 #T1132
2024-03-21
Secu I
#APT37 #RokRAT #LNK #T1573 #T1203 #T1036 #T1012 #T1106 #T1027 #T1564.003 #T1071 #T1057 #T1082 #T1485 #T1027.004 #T1548 #T1564.001 #T1564 #T1560 #T1202 #T1070 #T1497 #T1059.001 #T1033 #T1059 #T1003
2024-02-08
S2W
#D2Innovation #TrollStealer #Kimsuky #T1005 #T1518.001 #T1059.003 #T1083 #T1539 #T1059.001 #T1041 #T1588.004 #T1113 #T1016 #T1560 #T1555.003 #T1204.002 #T1087.001 #T1027.002 #T1071.001 #T1057 #T1082
« Back