Credentials from Password Stores

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.^[21]

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.^[24][25]

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.^[33]

Astaroth uses an external software known as NetPass to recover passwords. ^[16]

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.^[11]

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.^[3]

Leafminer used several tools for retrieving login and password information, including LaZagne.^[26]

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.^[20]

Matroyshka is capable of stealing Outlook passwords.^[14][15]

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.^[4][5][6][7]

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.^[27][28]

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.^{[29][30][31][32]}

OLDBAIT collects credentials from several email clients.^[17]

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.^[11]

PLEAD has the ability to steal saved passwords from Microsoft Outlook.^[19]

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.^[8][9]

A module in Prikormka collects passwords stored in applications installed on the victim.^[13]

Proton gathers credentials in files for 1password and keychains.^[12]

Pupy can use Lazagne for harvesting credentials.^[10]

QuasarRAT can obtain passwords from common FTP clients.^[1][2]

ROKRAT steals credentials by leveraging the Windows Vault mechanism.^[18]

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.^[22]

Turla has gathered credentials from the Windows Credential Manager tool.^[23]

The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.

Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.