Automation · API / MCP 中文

Technique note · T1697

Steal Application Specific Passwords

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access. An adversary may socially engineer a user into providing an ASP (using methods like Phishing for Information), generate an ASP for an already compromised account, or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

ATT&CK T1697 platforms — Status Active Version 20.1

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.12 An adversary may socially engineer a user into providing an ASP34 (using methods like Phishing for Information), generate an ASP for an already compromised account,56 or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

  1. Application Specific Passwords
  2. Application Specific Passwords Push Sec
  3. UNC6293 ASP Creative Phishing Attack
  4. Application Specific Passwords Phishing
  5. Mandiant APT42-untangling
  6. TAG APT42

Groups using this technique

GroupNameCountry
grp_g1044APT42Iran

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.