An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
Archive via Custom Method
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1560/003  external_id: T1560.003     source_name: ESET Sednit Part 2  description: ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.  url: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf     