Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1027.015: Compression

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).[1]

In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.[2]

File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File).[3] However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.[4]

Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.

EnterpriseT1027.015Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Compression matters because ordinary archive formats such as ZIP, gzip, 7z, and RAR are routine business tools, but ATT&CK documents their use to hide payloads, combine files, move content faster, and reduce the chance that security tools or analysts inspect the true contents. The business issue is not that archives are suspicious by themselves; it is whether email, endpoint, and malware-analysis controls can safely inspect compressed, concatenated, encrypted/password-protected, or self-extracting content across Windows, macOS, and Linux.

Executive priority

Treat this as a control-validation and resilience issue: compressed payloads can weaken prevention, triage, and incident response if archive inspection is inconsistent. Leaders should ask whether email security, endpoint antimalware, SOC workflows, and IR evidence handling can identify risky archive behavior without blocking normal business file exchange. This is especially relevant for audit evidence around malware protection, phishing defense, and endpoint monitoring because ATT&CK links this behavior to spearphishing attachments, malicious files, obfuscated files or information, and antimalware mitigation.

Technical view

For SOC, detection engineering, and IR teams, validate coverage around archive creation, receipt, extraction, and execution rather than relying only on file extension matching. ATT&CK provides no official detection text for this sub-technique, but the relationship to DET0281, Detection Strategy for Compressed Payload Creation and Execution, supports focusing on compressed payload creation and execution patterns. Review handling of ZIP, gzip, 7z, RAR, concatenated ZIP archives, self-extracting archives, and compressed shellcode or file content stored outside normal files, including the Windows Registry when connected to Fileless Storage context. Because this is a stealth sub-technique of Obfuscated Files or Information, detections should be correlated with delivery and user-execution context where available, including spearphishing attachment and malicious file activity.

Likely telemetry

  • Email gateway and attachment inspection results for archive files, including password-protected or encrypted archives where visible
  • Endpoint file creation, archive extraction, and process execution events on Windows, macOS, and Linux
  • Antivirus/antimalware alerts, quarantine events, and behavioral detections involving archive contents or self-extracting archives
  • File metadata and content-analysis results for ZIP, gzip, 7z, RAR, concatenated ZIP, and self-extracting archive formats
  • Command-line or process telemetry for archive utilities and extracted payload execution

Detection direction

  • Confirm whether security tools inspect archive contents recursively and consistently across ZIP, gzip, 7z, RAR, concatenated ZIP, encrypted/password-protected archives, and self-extracting archives.
  • Test whether archive readers and malware-analysis pipelines identify concatenated ZIP files; ATT&CK notes some ZIP readers may miss embedded archive central directories.
  • Correlate archive receipt or creation with extraction followed by execution, especially when the archive arrived as an email attachment or leads to user-driven malicious file execution.
  • Tune detections to reduce noise from normal business archiving by adding context such as source channel, sender reputation, unusual archive type, password protection, self-extracting behavior, child process execution, or antimalware verdicts.
  • Validate endpoint coverage across the listed platforms: Linux, macOS, and Windows. Do not assume Windows-only archive detections cover the full technique scope.

Mitigation priorities

  • Prioritize broad, current antivirus/antimalware deployment across devices, aligned to ATT&CK mitigation M1049, including signature, heuristic, and behavioral analysis capabilities.
  • Ensure email and endpoint controls can safely process common and evasive archive formats, including self-extracting and encrypted/password-protected cases where policy allows inspection or containment.
  • Define handling procedures for password-protected or uninspectable archives, since these can create blind spots for malware prevention and SOC triage.
  • Harden incident response playbooks so analysts preserve both the original archive and extracted contents for analysis, rather than analyzing only one view.
  • Use awareness and phishing-defense processes to reduce user interaction with unexpected archived attachments, consistent with the ATT&CK relationship to spearphishing attachments and malicious files.
Analyst notes and limits

This object is a stealth sub-technique under T1027 Obfuscated Files or Information. ATT&CK relationships show use by multiple groups and software families, including Molerats, Threat Group-3390, Gamaredon Group, Leviathan, WIRTE, Kimsuky, Mofang, Higaisa, TA2541, VOID MANTICORE, Winnti for Windows, RTM, ShimRat, Pony, WindTail, Hancitor, Pillowmint, SUNBURST, Kerrdown, RCSession, and Pandora. Those relationships show the behavior is broadly represented in ATT&CK reporting, but they should not be read as evidence of current targeting or exposure in a specific environment without local intelligence and telemetry.

The official ATT&CK object does not provide detection text, and the supplied relationship context gives only the name of DET0281 rather than full analytic details. This take therefore focuses on defensible validation areas from the description, platforms, tactics, mitigation relationship, and technique relationships. Local archive tooling, email policy, endpoint telemetry, and malware-analysis capability will determine actual coverage.

Official MITRE ATT&CK definition

Compression

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).[1]

In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.[2]

File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File).[3] However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.[4]

Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1027 Obfuscated Files or Information This object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0021: Molerats

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.[1][2][3][4]

Group Enterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

Group Enterprise

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G0126: Higaisa

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.[1][2][3]

Group Enterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

Group Enterprise

G0103: Mofang

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.[1]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Group Enterprise

G0090: WIRTE

WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]

Group Enterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

Malware Enterprise

S0453: Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.[1]

Windows
Malware Enterprise

S0148: RTM

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.[1][2]

Windows
Tool Enterprise

S1050: PcShare

PcShare is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.[1][2]

Windows
Malware Enterprise

S1228: PUBLOAD

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]

Windows
Malware Enterprise

S9020: LODEINFO

LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]

Windows
Malware Enterprise

S1183: StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

Windows
Relationship explorer

All related ATT&CK context

mitigates · Mitigation M1049: Antivirus/Antimalware Enterprise uses · Malware S0453: Pony Enterprise uses · Malware S0673: DarkWatchman Enterprise uses · Malware S0499: Hancitor Enterprise uses · Malware S0148: RTM Enterprise uses · Group G0021: Molerats Enterprise uses · Malware S1188: Line Runner Enterprise uses · Group G0027: Threat Group-3390 Enterprise uses · Tool S1050: PcShare Enterprise detects · Detection Strategy DET0281: Detection Strategy for Compressed Payload Creation and Execution Enterprise uses · Group G1055: VOID MANTICORE Enterprise uses · Group G0047: Gamaredon Group Enterprise uses · Malware S1228: PUBLOAD Enterprise uses · Malware S0517: Pillowmint Enterprise uses · Malware S0466: WindTail Enterprise uses · Malware S9020: LODEINFO Enterprise uses · Malware S1183: StrelaStealer Enterprise uses · Malware S0559: SUNBURST Enterprise uses · Malware S0665: ThreatNeedle Enterprise uses · Malware S1099: Samurai Enterprise uses · Malware S0141: Winnti for Windows Enterprise subtechnique of · Technique T1027: Obfuscated Files or Information Enterprise uses · Malware S0664: Pandora Enterprise uses · Malware S1081: BADHATCH Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1049: Antivirus/Antimalware

Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be implemented through the following measures:

Signature-Based Detection:

- Implementation: Use predefined signatures to identify known malware based on unique patterns such as file hashes, byte sequences, or command-line arguments. This method is effective against known threats. - Use Case: When malware like "Emotet" is detected, its signature (such as a specific file hash) matches a known database of malicious software, triggering an alert and allowing immediate quarantine of the infected file.

Heuristic-Based Detection:

- Implementation: Deploy heuristic algorithms that analyze behavior and characteristics of files and processes to identify potential malware, even if it doesn’t match a known signature. - Use Case: If a program attempts to modify multiple critical system files or initiate suspicious network communications, heuristic analysis may flag it as potentially malicious, even if no specific malware signature is available.

Behavioral Detection (Behavior Prevention):

- Implementation: Use behavioral analysis to detect patterns of abnormal activities, such as unusual system calls, unauthorized file encryption, or attempts to escalate privileges. - Use Case: Behavioral analysis can detect ransomware attacks early by identifying behavior like mass file encryption, even before a specific ransomware signature has been identified.

Real-Time Scanning:

- Implementation: Enable real-time scanning to automatically inspect files and network traffic for signs of malware as they are accessed, downloaded, or executed. - Use Case: When a user downloads an email attachment, the antivirus solution scans the file in real-time, checking it against both signatures and heuristics to detect any malicious content before it can be opened.

Cloud-Assisted Threat Intelligence:

- Implementation: Use cloud-based threat intelligence to ensure the antivirus solution can access the latest malware definitions and real-time threat feeds from a global database of emerging threats. - Use Case: Cloud-assisted antivirus solutions quickly identify newly discovered malware by cross-referencing against global threat databases, providing real-time protection against zero-day attacks.

**Tools for Implementation**:

- Endpoint Security Platforms: Use solutions such as EDR for comprehensive antivirus/antimalware protection across all systems. - Centralized Management: Implement centralized antivirus management consoles that provide visibility into threat activity, enable policy enforcement, and automate updates. - Behavioral Analysis Tools: Leverage solutions with advanced behavioral analysis capabilities to detect malicious activity patterns that don’t rely on known signatures.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
9d3509dc18cf52b9...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 9d3509dc18cf…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Trustwave Pillowmint June 2020

    Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.

    Open source URL
  2. [2]
    Perception Point

    Arthur Vaiselbuh, Peleg Cabra. (2024, November 7). Evasive ZIP Concatenation: Trojan Targets Windows Users. Retrieved March 3, 2025.

    Open source URL
  3. [3]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  4. [4]
    The Hacker News

    Ravie Lakshmanan. (2023, April 5). Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks. Retrieved March 3, 2025.

    Open source URL
  5. [5]
    mitre-attack T1027.015
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use