T1560.003: Archive via Custom Method
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.[1]
Analyst context for executives and security teams
Archive via Custom Method matters because it can make stolen data harder to recognize before it leaves the environment. Instead of using obvious tools such as standard zip utilities, an adversary may use custom compression or encryption logic, including simple XOR or stream-cipher style routines, to package collected data. For leaders, the risk is not the archive itself; it is that data staging and preparation for exfiltration may blend into normal file activity unless endpoint, file, and network evidence is retained and correlated.
Executive priority
Prioritize this technique when the organization has sensitive data, regulated records, payment data, government information, intellectual property, or environments where removable media and endpoint-resident malware are credible concerns. ATT&CK links this behavior to multiple groups, malware families, and a campaign, which makes it useful for validating collection-stage readiness across incident response, SOC monitoring, and audit evidence. Executives should ask whether teams can prove visibility into unusual file creation, encryption-like staging behavior, and pre-exfiltration data handling across Windows, Linux, and macOS systems.
Technical view
This is a collection-stage sub-technique of Archive Collected Data on Linux, macOS, and Windows. Because MITRE does not provide detection text for this object, defenders should validate coverage using the related detection strategy DET0438 and local telemetry rather than assuming standard archive-tool detections are sufficient. SOC and IR teams should look for evidence of collected files being transformed into new opaque or unusually structured files, especially where the process is not a known backup, security, compression, or business application. Relationship context shows use across Windows-focused malware, macOS malware, and multiplatform tooling, so detection logic should not be limited to one operating system.
Likely telemetry
- Endpoint process execution and command-line metadata where available
- File creation, modification, rename, and delete events in user, temporary, application, web server, and staging directories
- File metadata such as size changes, entropy indicators, extensions, magic bytes, and unexpected binary output formats
- Endpoint detection records for custom encryption or packing behavior when available
- Data loss prevention, file integrity monitoring, and sensitive data access logs
Detection direction
- Validate DET0438-aligned analytics against custom archival behavior, not only known archive utilities.
- Tune detections around unusual process-to-file relationships: non-archiver processes producing large opaque files, repeated read/write cycles over sensitive directories, or staging immediately before outbound transfer.
- Correlate collection-stage file activity with later exfiltration indicators; this technique is often meaningful because it prepares data for movement, not because compression alone is malicious.
- Account for false positives from backup agents, encryption software, installers, development tools, data science workflows, and legitimate application packaging.
- Check blind spots on macOS and Linux as well as Windows, since the ATT&CK platforms include all three.
Mitigation priorities
- Start with visibility: confirm endpoint and file telemetry is collected and retained on Windows, Linux, and macOS systems that handle sensitive data.
- Reduce unnecessary access to sensitive repositories so collection and staging require fewer compromised accounts or hosts to monitor.
- Apply least privilege and segmentation around high-value data stores, web servers, application servers, and systems that can reach sensitive files.
- Harden and monitor removable media use where business processes allow, given related software descriptions involving removable-device exfiltration.
- Use DLP, egress monitoring, and incident response playbooks to connect local archive staging with possible outbound movement.
Analyst notes and limits
The supplied ATT&CK object has no official detection guidance, so this take emphasizes validation questions and telemetry classes rather than definitive analytics. Relationship context includes a detection strategy, multiple groups, a campaign, and many software entries using the technique, including Windows, macOS, and multiplatform examples. Those relationships support broad defensive relevance but do not prove current activity in any specific environment.
This assessment is limited to the provided ATT&CK STIX fields, external references, and relationships. It does not establish active exploitation, victim exposure, attribution, or guaranteed detection coverage. Local baselines, business applications, endpoint tooling, and data-handling workflows are required to distinguish malicious custom archiving from legitimate compression, encryption, backup, or packaging activity.
Archive via Custom Method
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1560 | Archive Collected Data | This object subtechnique of Archive Collected Data. |
Groups, software, and campaigns
G0037: FIN6
G0052: CopyKittens
CopyKittens is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.[1][2][3]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
G0094: Kimsuky
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]
DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
G1048: UNC3886
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]
G0030: Lotus Blossom
Lotus Blossom is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, Lotus Blossom has also targeted entities such as digital certificate issuers.[1][2][3]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
S0438: Attor
S0657: BLUELIGHT
S0038: Duqu
S0603: Stuxnet
Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]
S0035: SPACESHIP
S0661: FoggyWeb
S0198: NETWIRE
S0448: Rising Sun
Rising Sun is a modular backdoor that was used extensively in Operation Sharpshooter between 2017 and 2019. Rising Sun infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed Rising Sun included some source code from Lazarus Group's Trojan Duuzer.[1]
S0491: StrongPity
StrongPity is an information stealing malware used by PROMETHIUM.[1][2]
S0258: RGDoor
S0169: RawPOS
S1059: metaMain
C0017: C0017
C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 11ec6780ffe9… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
ESET Sednit Part 2
ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
Open source URL -
[2]
mitre-attack T1560.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.