Credentials from Password Stores

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.^[2]

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.^[3][4]

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.^[5]

APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.^[6]

Astaroth uses an external software known as NetPass to recover passwords. ^[7]

BeaverTail has collected keys stored for Solana stored in .config/solana/id.json and other login details associated with macOS within /Library/Keychains/login.keychain or for Linux within /.local/share/keyrings.^[8]

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.^[9]

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.^[1]

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.^[10]

Evilnum can collect email credentials from victims.^[11]

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.^[12]

HEXANE has run cmdkey on victim machines to identify stored credentials.^[13]

KGH_SPY can collect credentials from WINSCP.^[14]

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.^[15]

Leafminer used several tools for retrieving login and password information, including LaZagne.^[16]

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.^[17]

Malteiro has obtained credentials from mail clients via NirSoft MailPassView.^[18]

Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.^[19]

Matryoshka is capable of stealing Outlook passwords.^[20][21]

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.^[22][23]

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.^{[24][25][26][27][28]}

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.^[18][29][30]

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.^[31][32][33]

NETWIRE can retrieve passwords from messaging and mail client applications.^[34]

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.^{[35][36][37][38]}

OLDBAIT collects credentials from several email clients.^[39]

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.^[1]

PLEAD has the ability to steal saved passwords from Microsoft Outlook.^[40]

PoshC2 can decrypt passwords stored in the RDCMan configuration file.^[41]

A module in Prikormka collects passwords stored in applications installed on the victim.^[42]

Pupy can use Lazagne for harvesting credentials.^[43]

QuasarRAT can obtain passwords from common FTP clients.^[44][45]

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.^[46][47][48]

During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.^[49]

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.^[50]

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.^[51]

XLoader can collect credentials stored in email clients.^[52][53]

The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.

Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.

Limit the number of accounts and services with permission to query information from password stores to only those required. Ensure that accounts and services with permissions to query password stores only have access to the secrets they require.

Perform regular software updates to mitigate exploitation risk.