Procedure examples

Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.

Axiom has used steganography to hide its C2 communications.

Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.

Higaisa used a FakeTLS session for C2 communications.

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.

APT39 has used different versions of Mimikatz to obtain credentials.

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.

Mustang Panda utilized “Hdump” to dump credentials from memory.

Tonto Team has used a variety of credential dumping tools.

APT32 used GetPassword_x64 to harvest credentials.

Suckfly used a signed credential-dumping tool to obtain victim account credentials.

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.

Sowbug has used credential dumping tools.

Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.

Axiom has been known to dump credentials.

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.

Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.

GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."

Kimsuky has gathered credentials using Mimikatz and ProcDump.

Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.

APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

HAFNIUM has used procdump to dump the LSASS process memory.

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.

FIN6 has used Windows Credential Editor for credential dumping.

Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.

Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.

UNC3886 has used MiniDump to dump process memory and search for cleartext credentials.

OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.

Ke3chang has dumped credentials, including by using Mimikatz.

APT1 has been known to use credential dumping using Mimikatz.

Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.

Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.

RedCurl used LaZagne to obtain passwords from memory.

MirrorFace has dumped LSASS memory for credential access.

Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.

Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.

Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.

Whitefly has used Mimikatz to obtain credentials.

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.

APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.