Technique:  Archive Collected Data
ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.
Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.
AppleSeed has compressed collected data before exfiltration.
It used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
It's backdoor has used LZMA compression and RC4 encryption before exfiltration.
Aria-body has used ZIP to compress data gathered on a compromised host.
It has compressed and encrypted data prior to exfiltration.
Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.
BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.
BLUELIGHT can zip files before exfiltration.
Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.
Cadelspy has the ability to compress stolen data into a .cab file.
Chrommme can encrypt and store on disk collected data before exfiltration.
Daserf hides collected data in password-protected .rar archives.
It has compressed data into .zip files prior to exfiltration.
Dtrack packs collected data into a password protected archive.
Emotet has been observed encrypting the data it collects before sending it to the C2 server.
Empire can ZIP directories on the target system.
Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.
Exaramel for Windows automatically encrypts files before sending them to the C2 server.
FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.
Following data collection, It has compressed log files into a ZIP archive prior to staging and exfiltration.
Gold Dragon encrypts data using Base64 before being sent to the command and control server.
The It group has been known to compress data before exfiltration.
Kessel can RC4-encrypt credentials before sending to the C2.
KONNI has encrypted data and files prior to exfiltration.
It has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.
It has archived victim's data prior to exfiltration.
LightNeuron contains a function to encrypt and store emails that it collects.
Lizar has encrypted data before sending it to the server.
It has manually archived stolen files from victim machines before exfiltration.
Lurid can compress data before sending it.
It stores zipped files with profile data from installed web browsers.
It has encrypted files and information before exfiltration.
NETWIRE has the ability to compress archived screenshots.
It encrypted the collected files' path with AES and then encoded them with base64.
Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.
PowerLess can encrypt browser database files prior to exfiltration.
After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.
Proton zips up files before exfiltrating them.
Remexi encrypts and adds all gathered browser data into files for upload to C2.
RunningRAT contains code to compress files.
ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.
TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.
VERMIN encrypts the collected files using 3-DES.
WellMail can archive files on the compromised host.
XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.
Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.