Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1560.002: Archive via Library

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile [1], libzip [2], and zlib [3]. Most libraries include functionality to encrypt and/or compress data.

Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

EnterpriseT1560.002Sub-techniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Archive via Library matters because collected data can be compressed or encrypted inside an application or implant without launching obvious archive utilities. For leaders, this is a data-loss and investigation-readiness issue: defenders may not see a familiar zip/rar command, yet sensitive files may still be staged for exfiltration on Linux, macOS, or Windows systems.

Executive priority

Prioritize this as part of collection and pre-exfiltration risk management. Ask whether SOC and IR teams can identify unusual archive creation, encrypted/compressed blobs, and suspicious file staging even when no command-line archive tool is executed. This is especially relevant for environments with sensitive intellectual property, regulated data, identity infrastructure, or servers where malware-linked relationships in ATT&CK show this behavior has appeared in multiple backdoors and threat group reporting.

Technical view

This sub-technique of T1560 focuses on compression or encryption performed through libraries such as rarfile, libzip, zlib, bzip2, or zip-linked functionality rather than standalone utilities. Detection should validate behavioral evidence around file collection, archive-like file headers, entropy changes, sudden creation of compressed/encrypted files, and processes writing staged data. Because MITRE provides no official detection text, teams should review DET0268 and test coverage against library-based archive creation across Windows, Linux, and macOS without relying only on command-line utility executions.

Likely telemetry

  • File creation and modification events for archive-like or high-entropy outputs
  • Endpoint process telemetry showing unusual processes writing compressed or encrypted files
  • File metadata, extensions, and magic-byte/file-header signatures
  • EDR observations of applications or malware-like processes loading or linking archive/compression libraries
  • Directory staging activity before outbound transfer

Detection direction

  • Do not depend only on detections for spawned archive utilities; this technique may occur inside a process through linked libraries.
  • Tune analytics for unusual archive-like outputs created by processes that do not normally package data.
  • Use file signatures and content characteristics where available, since extensions may be absent or misleading.
  • Correlate archive creation with prior collection behavior and subsequent exfiltration indicators under the broader T1560 context.
  • Account for legitimate software that uses compression libraries to reduce false positives, especially backup, packaging, development, and application-update workflows.

Mitigation priorities

  • First, confirm visibility: endpoint file, process, and library-loading telemetry should cover Windows, Linux, and macOS assets in scope.
  • Next, baseline legitimate compression-library use by business applications, backup tools, and developer workflows.
  • Restrict and monitor sensitive data staging locations where practical, especially on servers and identity-related infrastructure.
  • Strengthen data-loss and egress monitoring around systems that can access high-value data.
  • Include library-based archiving in incident response playbooks so responders do not dismiss cases where no archive utility command line exists.
Analyst notes and limits

ATT&CK relationships link this behavior to multiple malware entries and two groups, which supports treating it as a relevant post-compromise collection behavior. However, those relationships should be used for detection context and threat modeling, not as proof of current activity in any environment.

The supplied ATT&CK object has no official detection text and does not provide procedure-level detail here. Local validation is required to determine which libraries are present, which applications legitimately use them, and whether existing telemetry can distinguish benign compression from suspicious staging.

Official MITRE ATT&CK definition

Archive via Library

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile [1], libzip [2], and zlib [3]. Most libraries include functionality to encrypt and/or compress data.

Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1560 Archive Collected Data This object subtechnique of Archive Collected Data.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

Malware Enterprise

S0467: TajMahal

TajMahal is a multifunctional spying framework that has been in use since at least 2014. TajMahal is comprised of two separate packages, named Tokyo and Yokohama, and can deploy up to 80 plugins.[1]

Windows
Malware Enterprise

S0086: ZLib

ZLib is a full-featured backdoor that was used as a second-stage implant during Operation Dust Storm since at least 2014. ZLib is malware and should not be confused with the legitimate compression library from which its name is derived.[1]

Windows
Malware Enterprise

S0127: BBSRAT

BBSRAT is malware with remote access tool functionality that has been used in targeted compromises. [1]

Windows
Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S0348: Cardinal RAT

Cardinal RAT is a potentially low volume remote access trojan (RAT) observed since December 2015. Cardinal RAT is notable for its unique utilization of uncompiled C# source code and the Microsoft Windows built-in csc.exe compiler.[1]

Windows
Malware Enterprise

S0661: FoggyWeb

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S0467: TajMahal Enterprise uses · Malware S1141: LunarWeb Enterprise uses · Malware S0086: ZLib Enterprise uses · Malware S0127: BBSRAT Enterprise uses · Malware S0260: InvisiMole Enterprise subtechnique of · Technique T1560: Archive Collected Data Enterprise uses · Malware S0053: SeaDuke Enterprise detects · Detection Strategy DET0268: Detect Archiving via Library (T1560.002) Enterprise uses · Malware S0354: Denis Enterprise uses · Malware S0091: Epic Enterprise uses · Malware S0642: BADFLICK Enterprise uses · Malware S0348: Cardinal RAT Enterprise uses · Malware S0352: OSX_OCEANLOTUS.D Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S0661: FoggyWeb Enterprise uses · Malware S1044: FunnyDream Enterprise uses · Group G0027: Threat Group-3390 Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
6291d50fdc7aa747...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 6291d50fdc7a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    PyPI RAR

    mkz. (2020). rarfile 3.1. Retrieved February 20, 2020.

    Open source URL
  2. [2]
    libzip

    D. Baron, T. Klausner. (2020). libzip. Retrieved February 20, 2020.

    Open source URL
  3. [3]
    Zlib Github

    madler. (2017). zlib. Retrieved February 20, 2020.

    Open source URL
  4. [4]
    Wikipedia File Header Signatures

    Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.

    Open source URL
  5. [5]
    mitre-attack T1560.002
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use