Procedure examples

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Okrum was seen using modified Quarks PwDump to perform credential dumping.

LaZagne can perform credential dumping from MSCache to obtain account and password information.

Cachedump can extract cached password hashes from cache entry information.

Pupy can use Lazagne for harvesting credentials.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.

Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.

During C0027, Scattered Spider performed domain replication.

Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.

Storm-0501 has utilized DCSync to extract credentials from victims.

During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.

LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.

During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

PACEMAKER has the ability to extract credentials from OS memory.

MimiPenguin can use the `<PID>/maps` and `<PID>/mem` file to search for regex patterns and dump the process memory.

LaZagne can use the `<PID>/maps` and `<PID>/mem` files to identify regex patterns to dump cleartext passwords from the browser's process memory.

TeamPCP Cloud Stealer can scrape memory from the Runner.Worker process by reading `/proc/<pid>/mem` to extract secrets including plaintext tokens.

Mini Shai-Hulud has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.

During ShadowRay, threat actors used `cat /etc/shadow` to steal password hashes.

LaZagne can obtain credential information from /etc/shadow using the shadow.py module.

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.

During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.

During Frankenstein, the threat actors used Empire to gather various local system information.

During Operation Honeybee, the threat actors collected data from compromised hosts.

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.

During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to automatically gather sensitive data stored within the local system to include credentials, system configurations and sensitive operational data.

During C0015, the threat actors obtained files and data from the compromised network.

During the SolarWinds Compromise, APT29 extracted files from compromised networks.

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.

During Night Dragon, the threat actors collected files and other data from compromised systems.

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.

During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.

During C0026, the threat actors collected documents from compromised hosts.

During CostaRicto, the threat actors collected data and files from compromised networks.

APT38 has collected data from a compromised host.

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.

APT3 will identify Microsoft Office documents on the victim's computer.

Kimsuky has collected Office, PDF, and HWP documents from its victims. Kimsuky has also harvested victim files through the use of the `RecentFiles()` function that collects paths of recently accessed files by parsing .lnk shortcuts from `%APPDATA%\Microsoft\Windows\Recent`.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Patchwork collected and exfiltrated files from the infected system.

APT41 has uploaded files and data from a compromised host.

Dragonfly has collected data from local victim systems.

menuPass has collected various files from the compromised computers.

HAFNIUM has collected data and files from a compromised machine.

FIN6 has collected and exfiltrated payment card data from compromised systems.

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

FIN7 has collected files and other sensitive information from a compromised network.

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.