What is a Zip Bomb?

Written by: Brenda Buckman
Published: 6/18/2025
Last Updated: 3/27/2026

Understanding the “Zip of Death” and how to defend against it

What looks like an innocent compressed file can be a hidden cyber weapon. Welcome to the world of zip bombs—cleverly crafted “compressed grenades” that aim to overwhelm systems rather than infect them with malware. These files, though deceptively tiny, can disrupt servers and leave networks vulnerable to further attacks. They have also been used in the past to crash antivirus programs.

This article dives into the anatomy of a zip bomb, the threats they pose to systems, and the weapons security professionals can deploy to combat them and stay ahead of these sly denial-of-service tactics.

Key Takeaways

A zip bomb is a tiny file designed to cause massive system disruption. These files often appear harmless and are no larger than a few kilobytes — but once extracted, their content can explode into terabytes or even petabytes of junk data, crashing any system that attempts to unpack them.
Zip bombs serve as both a disruption tool and a cover for deeper attacks. They serve two main purposes: disruption — crashing systems or antivirus tools to enable attacker entry — and diversion, stalling cybersecurity defenses while sneaking in secondary payloads.
Their deceptive simplicity makes them a persistent and sneaky threat. Disguised as ordinary emails or innocuous file uploads, zip bombs often slip through standard filters and deceive users into manual interaction, especially in environments without advanced security tools. Additionally, some older antivirus programs will try to inspect all the file's contents, which could take days and leave the system exposed.
Defense requires a combination of technical controls, tools, and employee training. Best practices include limiting recursion depth and capping CPU and memory consumption during decompression, using proactive detection tools, and training employees to avoid opening zip files from unknown sources and to recognize unusual file patterns — such as tiny file sizes claiming to contain significant data.

What is a Zip Bomb?

A zip bomb, also known as a “decompression bomb” or “zip of death,” is a type of malicious archive file designed to overwhelm a system’s resources when decompressed. Unlike most malware, which corrupts or steals data, zip bombs create chaos by exhausting a system’s CPU, RAM, and storage capacity.

These files often appear harmless and are no larger than a few kilobytes. However, once extracted, their content can explode into terabytes or even petabytes of junk data, crashing any system that attempts to unpack them.

Zip bombs serve two main purposes in cyberattacks:

Disruption: Crash systems or antivirus tools to enable attacker entry.
Diversion: Stall cybersecurity defenses while sneaking in secondary payloads.

So... why should we care?

Though less common than phishing or ransomware, zip bombs present unique challenges. Their deceptive simplicity makes them a low-cost, high-impact tool for attackers. Here’s why they remain a significant cybersecurity risk:

Antivirus Evasion

Many zip bombs are not effectively detected by older antivirus scanners. Some older antivirus programs will try to inspect all the file’s contents, which could take days and leave the system exposed.

Denial of Service (DoS)

Zip bombs can knock servers offline or freeze systems during decompression, effectively creating a DoS attack. This disruption can lock users out of critical operations or leave entire networks vulnerable.

Stealthy Distribution

Disguised as ordinary emails or innocuous file uploads, zip bombs often slip through standard filters and deceive users into manual interaction, especially in environments without advanced security tools.

Non-Destructive Chaos

While zip bombs don’t delete or corrupt data, their ability to incapacitate systems is often more devastating than outright destruction.

How do Zip Bombs work?

Zip bombs take advantage of compression algorithms that can shrink massive amounts of data into tiny packages. The simplicity of their function is what makes them so dangerous.

Recursive compression

Many zip bombs use multiple layers of nested compression. A single archive file may contain hundreds of compressed folders within, leading to exponential data inflation once fully extracted.

Example: Take the infamous "42.zip," a zip bomb that’s only 42 KB in size but decompresses into 4.5 petabytes of data, thanks to recursive layers of 16 zip files per folder.

Non-recursive overlapping compression

More advanced zip bombs use non-recursive methods, where data segments overlap and compress more efficiently. This results in extreme data inflation with fewer layers, making detection harder.

Infinite decompression loops

These bombs embed structures that trap decompression algorithms in endless cycles, consuming all available memory and processing power

Types of Zip Bombs

Recursive Zip Bombs

These contain deeply nested zip files, forcing systems to unpack layer after layer until they collapse under the weight of the inflated data.

Non-recursive Zip Bombs

Rely on ingenious compression techniques to reduce large datasets into deceptively small files with minimal layering.

Weaponized Zip Bombs

Some zip bombs aren’t just about resource exhaustion. They serve as payload carriers, delivering malware after the decompression chaos has crippled defenses.

Real-world impacts of Zip Bombs

Resource exhaustion: Older antivirus scanners, servers, and endpoint machines are the primary targets, often crashing due to excessive demand on CPU, memory, or disk space.
Denial of service: By incapacitating systems with a swamped decompression process, zip bombs create a denial-of-service scenario, cutting off employees and users from critical operations.
Security system bypassing: Paused antivirus engines or delayed logs open gaps for attackers to exploit with more dangerous secondary malware.

Best practices for securing against Zip Bombs

Staying ahead of zip bomb threats involves combining tools, tactics, and training. Here’s how you can prevent these attacks effectively:

A) Proactive Detection with Huntress

The Huntress SOC ensures false positives are minimized while validating true risks. This targeted approach allows analysts to stay focused on strategic tasks.

B) Limiting Decompression Parameters

Modern decompression tools (e.g., WinRAR, 7-Zip) allow admins to set limits:

Restrict recursion depth to avoid infinite unpacking cycles.
Cap CPU and memory consumption during decompression efforts.
Set extraction size limits for unknown files.

C) Educating Your Team

Human error often enables zip bomb success. Leverage security awareness training so your employees know to:

Avoid opening zip files from unknown or unverified sources.
Double-check email links or file origins when in doubt.
Recognize unusual file patterns, such as tiny file sizes claiming to contain significant data.

D) Creating Collaborative Defense Networks

Participate in information-sharing groups, such as ISACs, to stay informed on emerging zip bomb tactics. Collaborating with an industry-wide defense community increases overall preparedness.

Wrapping Up

Zip bombs are digital chaos packed in a deceptively tiny file. With tools like endpoint detection and response, and security awareness training, you can safeguard your systems from falling victim to these crafty attacks.

FAQs About Remote Access

Decompressing a zip bomb can lock up your system’s resources, causing slowdowns, crashes, or a denial-of-service scenario.

Check for unusually high compression ratios, repetitive file structures, or small file sizes claiming to contain large datasets. Use sandbox extraction tools or Huntress for security awareness training.

Yes. While zip bombs are less common than ransomware or phishing, their simplicity ensures they remain effective against outdated systems or poorly monitored environments.

Deploying a zip bomb maliciously is illegal under most cybercrime laws. However, they are sometimes studied or crafted in controlled environments for educational purposes.

Absolutely. Zip bombs uploaded to cloud storage with unregulated extraction protocols can crash backend services or consume significant resources.

Many current antivirus solutions detect common zip bomb patterns, but advanced or modified versions may still bypass scanners.

Additional Resources

Cybersecurity 101

Learn what application security is and how it protects applications from vulnerabilities, safeguards data, and ensures secure access for users.

What is Application Security Posture Management (ASPM)?

Cybersecurity 101

Learn how ASPM provides continuous security visibility across the software development lifecycle, helping organizations prioritize risks and streamline remediation.

What Is Google Dorking? How Hackers Use Search Engines for Recon

Cybersecurity 101

Learn what Google Dorking is, how hackers use advanced search operators to find sensitive info, and steps to protect your business from this cybersecurity risk.

Protect What Matters

Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.

Try Huntress for Free

What is a Zip Bomb?

Understanding the “Zip of Death” and how to defend against it

Key Takeaways

What is a Zip Bomb?