Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.1 Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).2
- Kaspersky Autofill
- Chrome Roaming Profiles
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g0117 | Fox Kitten | — |
| grp_g1015 | Scattered Spider | — |
| grp_g0114 | Chimera | China |
| grp_g1036 | Moonstone Sleet | DPRK |
| grp_g1017 | Volt Typhoon | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0094 | Kimsuky | DPRK |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核;置信度与有效期按引用读取。