Credentials from Password Stores

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.^[1]

APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.^[2]

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.^[3][4]

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.^[5]

Astaroth uses an external software known as NetPass to recover passwords. ^[6]

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.^[7]

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.^[8]

Evilnum can collect email credentials from victims.^[9]

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.^[10]

KGH_SPY can collect credentials from WINSCP.^[11]

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.^[12]

Leafminer used several tools for retrieving login and password information, including LaZagne.^[13]

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.^[14]

Matryoshka is capable of stealing Outlook passwords.^[15][16]

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.^{[17][18][19][20][21]}

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.^[22][23][24]

NETWIRE can retrieve passwords from messaging and mail client applications.^[25]

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.^{[26][27][28][29]}

OLDBAIT collects credentials from several email clients.^[30]

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.^[8]

PLEAD has the ability to steal saved passwords from Microsoft Outlook.^[31]

A module in Prikormka collects passwords stored in applications installed on the victim.^[32]

Pupy can use Lazagne for harvesting credentials.^[33]

QuasarRAT can obtain passwords from common FTP clients.^[34][35]

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.^[36]

The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.

Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.