Skip to content

Compression

Subtechnique · ATTACK:enterprise:T1027.015

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.015",
  "title": "Compression",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/015",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--fbd91bfc-75c2-4f0c-8116-3b4e722906b3",
  "external_id": "T1027.015",
  "domain": "enterprise",
  "created": "2025-03-04T18:29:33.850Z",
  "modified": "2026-05-12T15:12:00.726Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Perception Point",
      "url": "https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/"
    },
    {
      "source_name": "NTT Security Flagpro new December 2021",
      "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
    },
    {
      "source_name": "The Hacker News",
      "url": "https://thehackernews.com/2023/04/hackers-using-self-extracting-archives.html"
    },
    {
      "source_name": "Trustwave Pillowmint June 2020",
      "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"
    }
  ]
}

Explicit source assertions (42)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b1d3aa7-eae6-4ab3-89ca-e4771696975e

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1927ea49-6d20-49d3-abf2-95e9122bf332

Malwarebytes Pony April 2016

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a3a4c9d-36d5-42c9-9375-063772d70e88

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34935ccb-b800-4c24-81de-4923ccd7c4ec

FireEye Hancitor

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--349f297f-48bf-4105-b92c-960c56aaaacf

Unit42 Redaman January 2019 · ESET RTM Feb 2017

ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--383a50af-eeeb-40e5-b4df-8a1a9c5baa69

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S1188 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a178815-48c8-41e6-814c-43d7f9a6fd17

Cisco ArcaneDoor 2024

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d63e19a-2b2b-4b00-834e-c7d6d5d1f8bb

Unit42 Emissary Panda May 2019 · Securelist LuckyMouse June 2018 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fa093ed-9fd6-4ef7-b17e-d8429a76938a

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4778b88c-f184-4889-b39c-90fa78e08df5

FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S9059 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ab2dd12-fdad-42e5-9dbb-495e85ae4644

Mandiant_UNC1549_Feb2024

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cb3f85c-491a-4f5d-a85a-b3f2791b697e

VenereCiscoTalos_Gamaredon_Mar2025

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5123b96d-ad7e-43e5-8de6-88bcd47b1ddb

Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · Palo Alto Networks, Unit 42

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--534ab21f-c155-46fd-85d0-19eb6b39aa2c

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--536d2d4b-e700-4353-9cfa-bacf25512225

Trustwave Pillowmint June 2020

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cfa0496-c016-4d5c-ba4a-044d1aecc00d

objective-see windtail2 jan 2019

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61162be6-8e6d-4a0c-8334-079161389b0d

Kaspersky LODEINFO OCT 2022

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7522bc84-384e-497f-8898-196283ba5ec1

PaloAlto StrelaStealer 2024 · Fortgale StrelaStealer 2023

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--765d5200-ec1b-401f-a92a-83ed31fed493

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c9d93d6-c50a-4f6c-8b1d-965ebbdcc268

Microsoft Analyzing Solorigate Dec 2020

ATTACK:enterprise:S0665 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82aad8b4-2a6d-4977-8110-9463222de8aa

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S1099 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83069106-073a-4cd9-8b37-b101ed60f3ff

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90a36ef9-cee8-4f4d-b81e-7cd6d2cca174

Novetta Winnti April 2015

ATTACK:enterprise:T1027.015 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92f9a003-2bd1-482e-bf0f-7ee7760a43a8

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93efb013-dab0-4b47-ac2c-0632ac2fea18

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--940e8f94-a0bf-43e9-b2e8-53dd9a3f0e6e

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9881b1e3-93fa-4af0-8848-69f7fe478b2f

Malwarebytes Higaisa 2020 · Zscaler Higaisa 2020

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2acfa7e-4ba4-42e0-ae13-068c17d7d7fa

Qualys Hermetic Wiper March 2022 · Symantec Ukraine Wipers February 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b057569e-0e0b-4e8e-9955-016a556b8248

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b31e0e76-0239-41fc-a9a8-7c62b00510e1

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0585 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b86ea4c6-4f1d-4f52-9191-28d3d4d610f7

Unit 42 KerrDown February 2019

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdc8d4d8-c0be-4de3-853b-512c6ccb2dcb

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1873784-f0d9-48f4-a9de-4bd1ec5038be

Cisco Operation Layover September 2021

ATTACK:enterprise:G0103 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c67a1234-2bb9-429f-8605-793ac03bd3bf

FOX-IT May 2016 Mofang

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d82eb228-1ec2-4be8-911d-99847916cbb7

Gen Digital Kimsuky HTTPTroy October 2025

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d88f8b58-2adb-4e8a-9adb-e51cbf88d4ab

Check Point Wirte NOV 2024 · Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d90871a8-1d79-4c9f-99c4-852d5f584392

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3189323-c5f2-46c4-8912-36a09f3317ad

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46d31bf-23d8-4464-96e8-aee04f745921

ESET Gelsemium June 2021

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f59a5bb3-372a-4242-928d-fa8ba2b0c710

CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe462e52-3e5e-498b-a247-3124a69ae9aa

CheckPoint_NimbusManticore_May2026

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff138201-bc3e-4a79-acbf-17b18e50d0fc

Red Canary SocGholish March 2024 · Secureworks Gold Prelude Profile

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.