Threat intelligence / Technique

Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)

88 recorded

Relationships

mitigates

from Audit

Mitigation

subtechnique-of

to Archive Collected Data

Technique

uses

from 2025 Poland Wiper Attacks

Campaign

uses

Group

uses

from Akira

Group

uses

Malware

uses

from APT1

Group

uses

from APT28

Group

uses

from APT28 Nearest Neighbor Campaign

Campaign

uses

from APT3

Group

uses

from APT33

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from APT41 DUST

Campaign

uses

from APT5

Group

uses

from Aquatic Panda

Group

uses

from BeaverTail

Malware

uses

from BRONZE BUTLER

Group

uses

from C0026

Campaign

uses

Malware

uses

from ccf32

Malware

uses

Tool

uses

Group

uses

from CopyKittens

Group

uses

Malware

uses

Malware

uses

from Cutting Edge

Campaign

uses

Malware

uses

Malware

uses

from Earth Lusca

Group

uses

from FIN13

Group

uses

from FIN8

Group

uses

from Fox Kitten

Group

uses

from FunnyDream

Campaign

uses

Group

uses

Group

uses

Malware

uses

Group

uses

Malware

uses

Malware

uses

from INC Ransom

Group

uses

from InvisibleFerret

Malware

uses

from InvisiMole

Malware

uses

Group

uses

Group

uses

Malware

uses

from Lotus Blossom

Group

uses

Malware

uses

from Magic Hound

Group

uses

Group

uses

Malware

uses

from Mini Shai-Hulud

Malware

uses

from MirrorFace

Group

uses

from MuddyWater

Group

uses

from Mustang Panda

Group

uses

Malware

uses

from Okrum

Malware

uses

Malware

uses

from Operation CuckooBees

Campaign

uses

from Operation Dream Job

Campaign

uses

from Operation Honeybee

Campaign

uses

from Operation Wocao

Campaign

uses

from Play

Group

uses

Malware

uses

Tool

uses

from PowerShower

Malware

uses

Malware

uses

from PUNCHBUGGY

Malware

uses

from Pupy

Tool

uses

Malware

uses

Tool

uses

Group

uses

Tool

uses

Malware

uses

from SampleCheck5000

Malware

uses

from Sea Turtle

Group

uses

from SolarWinds Compromise

Campaign

uses

Group

uses

from TeamPCP Cloud Stealer

Malware

uses

Group

uses

Malware

uses

Malware

uses

from Turla

Group

uses

Group

uses

from VOID MANTICORE

Group

uses

from Volt Typhoon

Group

uses

Malware

uses

from Wizard Spider

Group

6 external

References

mitre-attack

T1560.001

WinRAR Homepage

https://www.rarlab.com/

WinZip Homepage

https://www.winzip.com/win/en/

7zip Homepage

https://www.7-zip.org/

diantz.exe_lolbas

https://lolbas-project.github.io/lolbas/Binaries/Diantz/

Wikipedia File Header Signatures

https://en.wikipedia.org/wiki/List_of_file_signatures