ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Techniques

T1560.003sub-technique

Archive via Custom Method

Tactics: collection

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.

MITRE ATT&CK ↗

Linked entities · 24

subtechnique-ofT1560Archive Collected Data uses byG0094Kimsuky uses byG0037FIN6 uses byG0129Mustang Panda uses byG1048UNC3886 uses byG0030Lotus Blossom uses byG0032Lazarus Group uses byG0052CopyKittens uses byS0603Stuxnet uses byS0391HAWKBALL uses byS0503FrameworkPOS uses byS0491StrongPity uses byS0198NETWIRE uses byS0409Machete uses byS1030Squirrelwaffle uses byS0092Agent.btz uses byS0615SombRAT uses byS0036FLASHFLOOD uses byS0260InvisiMole uses byS0439Okrum uses byS0448Rising Sun uses byS0172Reaver uses byS0661FoggyWeb uses byS0098T9000