Procedure examples

Indrik Spider has searched files to obtain and exfiltrate credentials.

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.

Kimsuky has used tools that are capable of obtaining credentials from saved mail.

MuddyWater has run a tool that steals passwords saved in victim email.

Leafminer used several tools for retrieving login and password information, including LaZagne.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

TA505 has used malware to gather credentials from FTP clients and Outlook.

RedCurl used LaZagne to obtain passwords in files.

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.

Fox Kitten has accessed files to gain valid credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.

ShinyHunters has gathered PII from database infrastructure.