Input Capture T1056
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user…
- Tactics
- Collection, Credential Access
- Actors using it
- 29
- Sub-techniques
- 1
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- Sandworm TeamRussia · ELECTRUM, Telebots, IRON VIKING · 64 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- Threat Group-3390China · Earth Smilodon, TG-3390, Emissary Panda · 47 techniques
- FIN13Elephant Beetle · 42 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- APT39Iran · ITG07, Chafer, Remix Kitten · 39 techniques
- menuPassChina · Cicada, POTASSIUM, Stone Panda · 37 techniques
- Ke3changChina · APT15, Mirage, Vixen Panda · 37 techniques
- RedCurlRussia · 32 techniques
- APT42Iran · 29 techniques
- HEXANELyceum, Siamesekitten, Spirlin · 29 techniques
- Storm-181125 techniques
- Winter VivernTA473, UAC-0114 · 22 techniques
- DarkhotelSouth Korea · DUBNIUM, Zigzag Hail · 22 techniques
- APT5China · Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD · 22 techniques
- Tonto TeamChina · Earth Akhlut, BRONZE HUNTLEY, CactusPete · 14 techniques
- PLATINUM10 techniques
- FIN49 techniques
- Sowbug9 techniques
- Ajax Security TeamIran · Operation Woolen-Goldfish, AjaxTM, Rocket Kitten · 5 techniques
- Group5Iran · 4 techniques