TACTIC: COLLECTION
Archive via Utility (T1560.001): real cases
MITRE Definition ↗ Adversaries compress and password-protect stolen files using tools like 7-Zip, WinRAR, or tar.
Key Facts
Technique ID
T1560.001
Collection
Mapped Cases
1
Primary sources
Related Laws
0
Criminal statutes
- ATT&CK Technique Identifier: T1560.001.
- Tactical Phase: Collection.
- Substantiated in 1 primary court prosecution cases.
- Every associated case includes verbatim evidentiary excerpts from indictments or sworn affidavits.
Verified Evidentiary Case Records
U.S. v. Joshua Schulte (CIA Vault 7 Leak)
sentenced 2017-08-24
Primary Source Evidence Excerpt: Trial Transcript Day 8
"He compressed the entire CCI codebase into encrypted archives before transferring the files offsite."
U.S. District Court for the Southern District of New York
View full case dossier →