An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Archive Collected Data
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1560  external_id: T1560     source_name: DOJ GRU Indictment Jul 2018  description: Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.  url: https://www.justice.gov/file/1080281/download     source_name: Wikipedia File Header Signatures  description: Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.  url: https://en.wikipedia.org/wiki/List_of_file_signatures     