Procedure examples

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.

TA505 has used .iso files to deploy malicious .lnk files.

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.

APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.

UNC3886 has trojanized Fortinet firmware and replaced the legitimate `/usr/bin/tac_plus` TACACS+ daemon for Linux with a malicious version containing credential logging functionality.

APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.

APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.

Evilnum can collect email credentials from victims.

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.

Leafminer used several tools for retrieving login and password information, including LaZagne.

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.

Malteiro has obtained credentials from mail clients via NirSoft MailPassView.

HEXANE has run `cmdkey` on victim machines to identify stored credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.

APT3 has used tools to dump passwords from browsers.

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.

Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.

APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

FIN6 has used the Stealer One credential stealer to target web browsers.

Leafminer used several tools for retrieving login and password information, including LaZagne.

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.

TA505 has used malware to gather credentials from Internet Explorer.

RedCurl used LaZagne to obtain passwords from web browsers.

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.

Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.

APT42 has used custom malware to steal credentials.

LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.

HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.

Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.

Turla has gathered credentials from the Windows Credential Manager tool.

Stealth Falcon malware gathers passwords from the Windows Credential Vault.

Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network.

Indrik Spider has accessed and exported passwords from password managers.

Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.

UNC3886 has targeted KeyPass password database files for credential access.