Argamal RAT Compress-Archive data staging before exfiltration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the use of the PowerShell 'Compress-Archive' cmdlet to archive files within user-writable temporary or application directories. This behavior is often indicative of an attacker staging data prior to exfiltration.