Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1560: Archive Collected Data

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.[1] Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

EnterpriseT1560TechniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Archive Collected Data matters because it is often the staging point between internal data collection and data leaving the organization. Compression reduces volume; encryption can make review harder. For leaders, the practical question is whether the organization can see unusual packaging of sensitive data on Linux, macOS, and Windows before it becomes an exfiltration or breach-response problem.

Executive priority

Prioritize this as a control-evidence and incident-readiness issue. Because ATT&CK places this technique in the collection tactic and links it to multiple sub-techniques, defensive coverage depends on endpoint audit quality, file activity visibility, and the ability to correlate archiving behavior with prior collection and later network transfer. Executives should ask whether SOC and IR teams can prove they collect the logs needed to identify bulk archive creation, encrypted archives, or archive activity by unusual users, processes, or locations.

Technical view

T1560 covers compression and/or encryption of collected data before exfiltration across Linux, macOS, and Windows. ATT&CK provides no official detection text, but relationship context includes DET0526, Detect Archiving and Encryption of Collected Data, and mitigation M1047 Audit. Detection engineering should validate coverage across the related paths: archive via utility, archive via library, and archive via custom method. Utility-based activity may be visible through process and command-line auditing; library or custom-method activity may require file creation, file type, entropy, access-pattern, and parent-process context rather than simple tool-name matching.

Likely telemetry

  • Endpoint process creation and command-line logs for archive or encryption utilities where available
  • File creation, rename, size, extension, and location metadata for archive-like outputs
  • File header or file signature evidence for archive formats, where file inspection is permitted
  • User, host, and parent-process context around bulk file reads followed by archive creation
  • Audit logs from Linux, macOS, and Windows systems covering user activity and system configuration relevant to collection staging

Detection direction

  • Do not rely only on known utility names; ATT&CK notes utility, third-party library, and custom methods, so detections should include behavioral file-staging patterns.
  • Tune for context: legitimate backup, software packaging, administrative compression, developer builds, and log rotation can resemble this behavior.
  • Look for archive creation after access to sensitive repositories or many source files, especially when followed by outbound transfer indicators.
  • Use file signatures and metadata where available to reduce dependence on extensions, since extensions can be misleading.
  • Map detections separately for Windows, macOS, and Linux so platform-specific audit gaps are visible.

Mitigation priorities

  • Implement and regularly review auditing configurations, consistent with M1047 Audit, across systems where sensitive data may be collected.
  • Confirm audit logs capture process execution, file creation, and user activity needed to reconstruct archive staging events.
  • Establish baselines for legitimate archiving and encryption activity by role, host type, and business process.
  • Prioritize monitoring around sensitive data stores and systems where collection would create material business, compliance, or operational risk.
  • Ensure incident response playbooks treat unexpected archive creation as a possible collection-stage signal and correlate it with access history and network activity.
Analyst notes and limits

This technique consolidates older revoked concepts for compressed data and encrypted data, and has sub-techniques for utility, library, and custom methods. The breadth of related groups and software shows the behavior is common across different threat reporting, but those relationships should be used for context, not as evidence of current targeting in any specific environment.

MITRE does not provide an official detection description for this object. The supplied relationship to DET0526 identifies a detection strategy, but its detailed content is not included here. Local validation is required to determine whether endpoint, file, audit, and network telemetry can actually observe this behavior in the organization’s environment.

Official MITRE ATT&CK definition

Archive Collected Data

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.[1] Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

5 rows
Domain ID Name Relationship / procedure
Enterprise T1560.002 Archive via Library Sub-technique Archive via Library subtechnique of this object.
Enterprise T1560.001 Archive via Utility Sub-technique Archive via Utility subtechnique of this object.
Enterprise T1022 Data Encrypted Data Encrypted revoked by this object.
Enterprise T1002 Data Compressed Data Compressed revoked by this object.
Enterprise T1560.003 Archive via Custom Method Sub-technique Archive via Custom Method subtechnique of this object.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0035: Dragonfly

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]

Group Enterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

Group Enterprise

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

Group Enterprise

G1003: Ember Bear

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]

Group Enterprise

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G0050: APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]

Group Enterprise

G0037: FIN6

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.[1][2]

Group Enterprise

G1014: LuminousMoth

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.[1][2]

Group Enterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

Group Enterprise

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

Malware Enterprise

S0667: Chrommme

Chrommme is a backdoor tool written using the Microsoft Foundation Class (MFC) framework that was first reported in June 2021; security researchers noted infrastructure overlaps with Gelsemium malware.[1]

Windows
Malware Enterprise

S0045: ADVSTORESHELL

ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. [1] [2]

Windows
Tool Enterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Malware Enterprise

S1039: Bumblebee

Bumblebee is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. Bumblebee has been linked to ransomware operations including Conti, Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.[1][2][3]

Windows
Relationship explorer

All related ATT&CK context

uses · Group G0035: Dragonfly Enterprise uses · Malware S0667: Chrommme Enterprise uses · Group G0040: Patchwork Enterprise detects · Detection Strategy DET0526: Detect Archiving and Encryption of Collected Data (T1560) Enterprise uses · Malware S0343: Exaramel for Windows Enterprise uses · Malware S0586: TAINTEDSCRIBE Enterprise uses · Group G0001: Axiom Enterprise uses · Malware S1101: LoFiSe Enterprise uses · Tool S0521: BloodHound Enterprise uses · Malware S0045: ADVSTORESHELL Enterprise uses · Group G1003: Ember Bear Enterprise uses · Tool S0363: Empire Enterprise subtechnique of · Technique T1560.002: Archive via Library Enterprise uses · Malware S1039: Bumblebee Enterprise uses · Malware S0515: WellMail Enterprise uses · Group G1043: BlackByte Enterprise uses · Malware S9032: MuddyViper Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S0454: Cadelspy Enterprise uses · Malware S1140: Spica Enterprise uses · Malware S0395: LightNeuron Enterprise uses · Malware S1196: Troll Stealer Enterprise uses · Group G0007: APT28 Enterprise subtechnique of · Technique T1560.001: Archive via Utility Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
7acc3d7cc7adefea...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 7acc3d7cc7ad…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    DOJ GRU Indictment Jul 2018

    Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    Wikipedia File Header Signatures

    Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.

    Open source URL
  3. [3]
    mitre-attack T1560
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use