1. Home
  2. Software
  3. CRASHPAD

CRASHPAD

CRASHPAD is a Windows executable written in C++ that gathers data from web browsers.[1] CRASHPAD  was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9057
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 28 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1134 .001 Access Token Manipulation: Token Impersonation/Theft

CRASHPAD has impersonated the explorer.exe user privileges to call Windows API CryptUnprotectData.[1]

Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

CRASHPAD has extracted credentials saved within web browsers.[1]

Enterprise T1140 Deobfuscate/Decode Files or Information

CRASHPAD has decrypted the config file C:\Program Files\VMware\VMware Tools\VMware VGAuth\config.txt to move the contents to a newly created file called C:\Program Files\VMware\VMware Tools\VMware VGAuth\crash.log.[1]
Enterprise T1106 Native API

CRASHPAD has leveraged Windows Native API, such as CryptUnprotectData, to decrypt functions.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

CRASHPAD  has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.