Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Both compression and encryption are done prior to exfiltration, and can be performed using a utility, programming library, or custom algorithm.
| ID | Name | Description |
|---|---|---|
| S0422 | Anubis |
Anubis exfiltrates data encrypted (with RC4) by its ransomware module.[1] |
| S0540 | Asacub |
Asacub has encrypted C2 communications using Base64-encoded RC4.[2] |
| S1079 | BOULDSPY | |
| S1094 | BRATA |
BRATA has compressed data with the |
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to exfiltrate encrypted data to the C2 server.[5] |
| S1243 | DCHSpy |
DCHSpy has compressed and encrypted collected data with a password from the C2 server.[6] |
| S0505 | Desert Scorpion |
Desert Scorpion can encrypt exfiltrated data.[7] |
| S0405 | Exodus |
Exodus One encrypts data using XOR prior to exfiltration.[8] |
| S0577 | FrozenCell |
FrozenCell has compressed and encrypted data before exfiltration using password protected .7z archives.[9] |
| S0535 | Golden Cup |
Golden Cup has encrypted exfiltrated data using AES in ECB mode.[10] |
| S0421 | GolfSpy |
GolfSpy encrypts data using a simple XOR operation with a pre-configured key prior to exfiltration.[11] |
| S1185 | LightSpy |
LightSpy collects and compresses data to be exfiltrated using SSZipArchive.[12][13] |
| S1082 | Sunbird | |
| S0424 | Triada |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0670 | Detection of Archive Collected Data | AN1767 |
For Android, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App reads files across multiple directories or databases in background state (collection phase) then invokes archive or compression routines on collected content — read-then-archive sequence is the staging chain]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes archive-like container, high-entropy packaged blob, or .zip/.gz output to app-private or cache path after bulk data collection — archive artifact in private storage is the staging evidence]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1768 |
For iOS, detect Archive Collected Data from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes large container, temp package, or high-entropy blob to container-local storage after clustered data access — staged archive artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |