Log in Request a demo

Attack technique

Archive Collected Data

Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out.

In short

Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. This makes the data smaller and harder for a defender to read or notice. The attacker can use a utility already on the system, a third party library or a custom method. MITRE ATT&CK tracks it as T1560 under Collection.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Collection · Step 12 Of 15 In The Attack Chain

  1. MITRE IDT1560ATT&CK technique
  2. Detection4ways to spot itCheck staging locations · Spot odd parent processes
  3. Defences1ways to stop it

How it works

After an attacker gathers data, they often prepare it for removal. Compressing it reduces the amount that has to cross the network. MITRE notes this can also help obscure the contents.

Encryption can hide what is being sent out, which makes the transfer less obvious if someone inspects it. Both steps happen before the data leaves.

The attacker can use a utility already on the system, a third party library, or their own custom method. MITRE tracks these as three sub-techniques.

A real example

MITRE ATT&CK lists these procedure examples:

  • ADVSTORESHELL encrypts data with the 3DES algorithm and a hardcoded key before exfiltration.
  • Agent Tesla can encrypt data with 3DES before sending it to a command server.
  • AppleSeed has compressed collected data before exfiltration.

How to detect

  1. Watch archive and encryption tools

    Look for compression or encryption utilities started in unusual ways, followed by the creation of large compressed or encrypted files.

  2. Check staging locations

    Look for archive files appearing in temporary or staging folders, especially when created by processes that do not normally make them.

  3. Spot odd parent processes

    On macOS, look for archive tools launched by office apps, browsers or background services, and for archive containers that do not match normal activity.

  4. Detection strategy MITRE lists

    DET0526, Detect Archiving and Encryption of Collected Data (T1560).

How to defend

  1. Audit for unauthorized archive tools

    Run system scans to find archival utilities that should not be on a machine. MITRE lists this as the one mitigation for the technique.

Questions

What is Archive Collected Data?

It is a technique where an attacker compresses or encrypts gathered data before removing it from the network. Compression reduces the amount that must cross the network, and encryption hides what is sent. MITRE ATT&CK tracks it as T1560.

What tools do attackers use to archive data?

They can use a utility already on the system, a third party library, or their own custom method. MITRE tracks these as three separate sub-techniques of Archive Collected Data.

How can defenders detect data archiving by attackers?

Look for compression or encryption utilities started in unusual ways, followed by large compressed or encrypted files. Check temporary and staging folders for archives made by processes that do not normally create them.

How do you defend against Archive Collected Data?

Run system scans to find archival utilities that should not be on a machine. MITRE lists this audit as the one mitigation for the technique, so detection of unusual archiving matters too.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. Akira ransomware advisory AA24-109A: stages and tools October 2026
  3. Xehook Stealer Technical Analysis June 2024
  4. Phemedrone Stealer Technical Analysis March 2024
  5. Andariel Threat group
  6. APT1 Threat group

Sources

  1. MITRE ATT&CK T1560: Archive Collected Data MITRE
  2. MITRE ATT&CK Exfiltration (TA0010) MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT1

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Read more