T1560

Archive Collected Data

discovered 2026-07-01

Harvested credential-file contents are gzip-compressed in-process (Node zlib) before exfiltration, reducing beacon size and bypassing naive plaintext-content inspection.

View on MITRE ATT&CK

Seen in packages

Campaigns