Archive-based delivery is the use of compressed files such as RAR or ZIP archives to transport malicious payloads, staging artefacts, or deceptive links. It exploits trust in file compression and can bypass controls that focus only on obvious executable attachments.
What Archive-Based Delivery Means in Security Operations
Archive-based delivery is a delivery technique, not a file format in itself. Compression containers such as ZIP and RAR can bundle multiple files, preserve naming tricks, and make malicious material look routine enough to pass a quick glance.
Security teams usually care less about the archive extension and more about what the archive is hiding, how it was delivered, and whether the contents are allowed by policy. That is why archive handling belongs in the same conversation as attachment filtering, sandboxing, and user awareness.
Why Attackers Use Archives
Archives are useful to attackers because they can reduce visual suspicion and create an extra unpacking step before inspection. A ZIP file may contain a payload, a script, or a link file that only becomes obvious after extraction, which can frustrate controls that focus on direct executable attachments.
Archives also support staging. A malicious archive can hold an initial loader alongside supporting files, or package deceptive content that helps the next step succeed. For defenders, that means the archive is often part of a chain, not the final payload itself.
How Archive-Based Delivery Works
At a technical level, archive-based delivery relies on the way mail gateways, browsers, and endpoint tools treat compressed files. The archive may arrive by email, download, chat, or file-sharing link, then be extracted by the user or by automation before the harmful file is visible.
Some archives are designed to exploit trust rather than cryptography. Password-protected archives, nested archives, and oddly named files can delay detection or defeat simple content scanning. The tactic is effective when controls inspect only common executable types and do not examine decompressed contents deeply enough.
For broader supply-chain and delivery integrity concerns, teams often pair content inspection with software provenance controls such as SLSA and hardening guidance like CIS Benchmarks to reduce exposure from untrusted content paths.
Defensive Controls and Inspection Priorities
Good handling starts with treating archive contents as active risk-bearing material. Mail and web controls should inspect nested files, flag password-protected archives, and apply policy based on extracted content rather than only the outer container. Endpoint protection should also see whether the archive is being used to stage scripts, links, or secondary payloads.
Detection becomes stronger when teams correlate archive receipt with follow-on behaviour such as unusual child processes, suspicious file drops, or outbound connections after extraction. That context matters because the archive itself is often only the delivery mechanism, while the real security event happens during execution or user interaction.
Archive delivery is also a governance issue for software and content supply chains. Baselines from OWASP SAMM and control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls both support deeper inspection, stronger change discipline, and better handling of untrusted artefacts.
Risk and Threat Considerations
Archive-based delivery is risky because it can move malicious content through channels that users and controls often consider low-friction or familiar. The main danger is not the compression format itself, but the trust gap between what the archive looks like and what it actually contains.
Failure mechanism: Defenders may inspect only the outer file type, allow password-protected or nested archives through, or miss a harmful payload that becomes visible only after extraction.
Impact: That gap can lead to malware execution, initial access, staging for later compromise, or successful delivery of deceptive links and files that would otherwise be blocked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP SAMM set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply-chain Levels for Software Artifacts | Archive delivery can hide staged artefacts that affect artifact integrity. |
| Recommendation — Verify artifact provenance and reject untrusted archive-delivered build inputs. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Archive-based payloads often bypass weak inspection and reach endpoints. |
| Recommendation — Scan extracted content and quarantine suspicious archives before execution. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Archive contents may carry malware that requires inspection beyond the container. |
| Recommendation — Inspect decompressed files and block malicious content before it reaches users. | ||
| OWASP SAMM | S-DP — Defect Management | Secure delivery practices benefit from stronger controls on untrusted packaged content. |
| Recommendation — Embed archive inspection and rejection rules into secure delivery practices. | ||
Practitioner Guidance
What to watch for: Prioritise archive files that arrive unexpectedly, are password-protected, contain multiple nested layers, or include file types that do not match the claimed business purpose. Those are common indicators that the archive is being used to hide intent rather than simply compress data.
Governance implication: Treat archive handling as a policy decision across email, download, collaboration, and endpoint layers, not as a one-off malware filter setting. Clear handling rules should define when archives are allowed, when they must be decompressed for inspection, and when they should be quarantined.
Related resources from NHI Mgmt Group
- What do security teams get wrong about archive-based malware delivery?
- What breaks when trust-based malware delivery is not monitored closely?
- How should security teams implement risk-based code review in high-velocity delivery?
- How should security teams implement dynamic application security testing in GitHub-based delivery pipelines?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org