Adversaries may acquire user credentials from third-party password managers.1 Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.2 Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.34 Adversaries may extract credentials from memory via Exploitation for Credential Access.5 Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.6
- ise Password Manager February 2019
- ise Password Manager February 2019
- FoxIT Wocao December 2019
- Github KeeThief
- NVD CVE-2019-3610
- Cyberreason Anchor December 2019
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0117 | Fox Kitten | — |
| grp_g0119 | Indrik Spider | Russia |
| grp_g1015 | Scattered Spider | — |
| grp_g1048 | UNC3886 | — |
| grp_g1053 | Storm-0501 | — |
| grp_g1004 | LAPSUS$ | — |
| grp_g0027 | Threat Group-3390 | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.