An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.1
- ESET Sednit Part 2
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0129 | Mustang Panda | China |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0052 | CopyKittens | Iran |
| grp_g0037 | FIN6 | — |
| grp_g1048 | UNC3886 | — |
| grp_g0030 | Lotus Blossom | — |
| grp_g0094 | Kimsuky | DPRK |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.