An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.
Groups using this technique
No group use in the reference set yet.
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.