H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Archive via Library

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

17 recorded

Relationships

subtechnique-of
to Archive Collected Data
Technique
uses
from BADFLICK
Malware
uses
from BBSRAT
Malware
uses
from Cardinal RAT
Malware
uses
from Denis
Malware
uses
from Epic
Malware
uses
from FoggyWeb
Malware
uses
from FunnyDream
Malware
uses
from InvisiMole
Malware
uses
from Lazarus Group
Group
uses
from LunarWeb
Malware
uses
from OSX_OCEANLOTUS.D
Malware
uses
from SeaDuke
Malware
uses
from ShinyHunters
Group
uses
from TajMahal
Malware
uses
from Threat Group-3390
Group
uses
from ZLib
Malware
5 external

References

mitre-attack
T1560.002
open
libzip
https://libzip.org/
open
Zlib Github
https://github.com/madler/zlib
open
PyPI RAR
https://pypi.org/project/rarfile/
open
Wikipedia File Header Signatures
https://en.wikipedia.org/wiki/List_of_file_signatures
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance