Unsecured Credentials T1552
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in…
- Tactics
- Credential Access
- Actors using it
- 26
- Sub-techniques
- 6
Ransomware groups reported using it
thegentlemenakiraplaynightspire
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- MuddyWaterIran · Earth Vetala, MERCURY, Static Kitten · 48 techniques
- NIMBUS MANTICOREUNC1549, TA455, COBALT SMOKEY · 45 techniques
- Salt TyphoonChina · 43 techniques
- TeamTNT43 techniques
- FIN13Elephant Beetle · 42 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586 · 39 techniques
- ShinyHuntersUNC6240, Bling Libra · 39 techniques
- Storm-050134 techniques
- RedCurlRussia · 32 techniques
- LAPSUS$DEV-0537, Strawberry Tempest · 32 techniques
- Fox KittenIran · UNC757, Parisite, Pioneer Kitten · 31 techniques
- TeamPCPPCPCat, ShellForce, DeadCatx3 · 30 techniques
- RockeChina · 29 techniques
- Indrik SpiderRussia · Evil Corp, Manatee Tempest, DEV-0243 · 27 techniques
- TA505Hive0065, Spandex Tempest, CHIMBORAZO · 24 techniques
- APT33Iran · HOLMIUM, Elfin, Peach Sandstorm · 23 techniques
- LeafminerIran · Raspite · 14 techniques