Procedure examples

TA505 has used malware to gather credentials from FTP clients and Outlook.

RedCurl used LaZagne to obtain passwords in files.

Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.

Fox Kitten has accessed files to gain valid credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.

ShinyHunters has gathered PII from database infrastructure.

APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.

RedCurl used LaZagne to obtain passwords in the Registry.

VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.

Kimsuky has accessed a Local State files associated with Chromium-based browsers that contain the AES key used to encrypt passwords stored in the browser to include `app_bound_encrypted_key`.

Volt Typhoon has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.

TeamTNT has searched for unsecured SSH keys.

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.

Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.

Storm-0501 has leveraged the Azure Owner role to access and steal the Storage Account Access keys using the `Microsoft.Storage/storageAccounts/listkeys/action` operation.

TeamPCP has used malware to extract SSH and GPG keys from victim environments.

TeamTNT has queried the AWS instance metadata service for credentials.

Wizard Spider has used PowerShell cmdlets `Get-GPPPassword` and `Find-GPOPassword` to find unsecured credentials in a compromised network group policy.

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.

LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.

Axiom has used digital certificates to deliver malware.

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.

FIN6 has used Comodo code-signing certificates.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.

OilRig has signed its malware with stolen certificates.

Suckfly has used stolen certificates to sign its malware.

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."

Leviathan has used stolen code signing certificates to sign malware.

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.

Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.

LuminousMoth has signed their malware with a valid digital signature.

Winnti Group used stolen certificates to sign its malware.

Lazarus Group has digitally signed malware and utilities to evade detection.

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Wizard Spider has used Digicert code-signing certificates for some of its malware.

Molerats has used forged Microsoft code-signing certificates on malware.

PROMETHIUM has signed code with self-signed certificates.

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

TeamPCP has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.