Unsecured Credentials: Credentials In Files, Sub-technique T1552.001 - Enterprise (original) (raw)
AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.[6]
Agent Tesla has the ability to extract credentials from configuration or support files.[7]
Anthropic AI-orchestrated Campaign
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to extract authentication certificates stored in system configuration files across compromised environments.[8]
APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.[9]
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[10][11]
Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.[12]
BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.[13][14]
Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.[15]
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user. [16][17]
Empire can use various modules to search for files containing passwords.[18]
FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.[19]
Fox Kitten has accessed files to gain valid credentials.[20]
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.[3]
Indrik Spider has searched files to obtain and exfiltrate credentials.[21]
jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.[22]
Kimsuky has used tools that are capable of obtaining credentials from saved mail.[23]
LaZagne can obtain credentials from chats, databases, mail, and WiFi.[24]
Leafminer used several tools for retrieving login and password information, including LaZagne.[25]
Leviathan Australian Intrusions
Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.[26]
MuddyWater has run a tool that steals passwords saved in victim email.[27]
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.[28][29][30][31]
If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.[32]
PoshC2 contains modules for searching for passwords in local and remote files.[33]
Pupy can use Lazagne for harvesting credentials.[34]
Pysa has extracted credentials from the password database before encrypting the files.[35]
QuasarRAT can obtain passwords from FTP clients.[36][37]
RedCurl used LaZagne to obtain passwords in files.[38][39]
Scattered Spider Spider searches for credential storage documentation on a compromised host.[40][41][42]
Shai-Hulud has gathered sensitive data stored in the Node.JS file process.env to include credentials and API keys.[43][44][45] Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include ~/.aws/credentials, application_default_credentials.json, and azureProfile.json.[46][47][44][45] Shai-Hulud has also targeted credentials and tokens stored in NPM files .npmrc and GitHub config files.[46][47][44][45]
SharePoint ToolShell Exploitation
During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.[48][49][50][51][52]
Smoke Loader searches for files named logins.json to parse for credentials.[53]
StrelaStealer searches for and if found collects the contents of files such as logins.json and key4.db in the $APPDATA%\Thunderbird\Profiles\ directory, associated with the Thunderbird email application.[54][55]
TA505 has used malware to gather credentials from FTP clients and Outlook.[56]
TeamTNT has searched for unsecured AWS credentials and Docker API credentials.[57][58][59]
TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP.[60][61] Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.[62]
TruffleHog has obtained credentials stored in config files and credential files in victim environments.[63][46]
XTunnel is capable of accessing locally stored passwords on victims.[64]