H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Archive Collected Data

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

63 recorded

Relationships

mitigates
from Audit
Mitigation
revoked-by
from Data Compressed
Technique
revoked-by
from Data Encrypted
Technique
subtechnique-of
from Archive via Custom Method
Technique
subtechnique-of
from Archive via Library
Technique
subtechnique-of
from Archive via Utility
Technique
uses
from ADVSTORESHELL
Malware
uses
from Agent Tesla
Malware
uses
from AppleSeed
Malware
uses
from APT28
Group
uses
from APT32
Group
uses
from Aria-body
Malware
uses
from Axiom
Group
uses
from Backdoor.Oldrea
Malware
uses
from BlackByte
Group
uses
from BloodHound
Tool
uses
from BLUELIGHT
Malware
uses
from Bumblebee
Malware
uses
from Cadelspy
Malware
uses
from Chrommme
Malware
uses
from Daserf
Malware
uses
from Dragonfly
Group
uses
from Dtrack
Malware
uses
from Ember Bear
Group
uses
from Empire
Tool
uses
from Epic
Malware
uses
from Exaramel for Windows
Malware
uses
from FELIXROOT
Malware
uses
from FIN6
Group
uses
from Gold Dragon
Malware
uses
from JumbledPath
Malware
uses
from Ke3chang
Group
uses
from Kessel
Malware
uses
from KONNI
Malware
uses
from Lazarus Group
Group
uses
from Leviathan
Group
uses
from LightNeuron
Malware
uses
from Lizar
Malware
uses
from LoFiSe
Malware
uses
from LP-Notes
Malware
uses
from LuminousMoth
Group
uses
from Lurid
Malware
uses
from Machete
Malware
uses
from menuPass
Group
uses
from Mini Shai-Hulud
Malware
uses
from MuddyViper
Malware
uses
from NETWIRE
Malware
uses
from Patchwork
Group
uses
from Pillowmint
Malware
uses
from PowerLess
Malware
uses
from Prikormka
Malware
uses
from Proton
Malware
uses
from Raccoon Stealer
Malware
uses
from Remexi
Malware
uses
from RunningRAT
Malware
uses
from ShimRatReporter
Tool
uses
from Spica
Malware
uses
from TAINTEDSCRIBE
Malware
uses
from Troll Stealer
Malware
uses
from VERMIN
Malware
uses
from WellMail
Malware
uses
from XCSSET
Malware
uses
from Zebrocy
Malware
3 external

References

mitre-attack
T1560
open
DOJ GRU Indictment Jul 2018
https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf
open
Wikipedia File Header Signatures
https://en.wikipedia.org/wiki/List_of_file_signatures
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance