AMOS - Ditto Archive Generation (T1560.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies the use of the macOS ditto utility to compress stolen datasets into a single archive, specifically preserving resources, as observed in AMOS malware activity.