Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.1 Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).2
- Kaspersky Autofill
- Chrome Roaming Profiles
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0117 | Fox Kitten | — |
| grp_g1015 | Scattered Spider | — |
| grp_g0114 | Chimera | China |
| grp_g1036 | Moonstone Sleet | DPRK |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0094 | Kimsuky | DPRK |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.