Threat intelligence / Technique

Credentials from Password Stores

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

50 recorded

Relationships

mapped-to

from Collect Data from Common Resource Locations

Technique

mitigates

from Password Policies

Mitigation

mitigates

from Privileged Account Management

Mitigation

mitigates

from Update Software

Mitigation

subtechnique-of

from Cloud Secrets Management Stores

Technique

subtechnique-of

from Credentials from Web Browsers

Technique

subtechnique-of

Technique

subtechnique-of

from Password Managers

Technique

subtechnique-of

from Securityd Memory

Technique

subtechnique-of

from Windows Credential Manager

Technique

uses

from 2025 Poland Wiper Attacks

Campaign

uses

from Agent Tesla

Malware

uses

from APT33

Group

uses

from APT39

Group

uses

from APT41

Group

uses

Malware

uses

from BeaverTail

Malware

uses

Malware

uses

from CosmicDuke

Malware

uses

Malware

uses

Group

uses

from FIN6

Group

uses

Group

uses

Malware

uses

Tool

uses

Group

uses

Malware

uses

Group

uses

Malware

uses

from Matryoshka

Malware

uses

from MgBot

Malware

uses

Tool

uses

from MirrorStealer

Malware

uses

Malware

uses

from MuddyWater

Group

uses

Malware

uses

Group

uses

Malware

uses

Malware

uses

from PLEAD

Malware

uses

Tool

uses

Malware

uses

from Pupy

Tool

uses

Tool

uses

from RedLine Stealer

Malware

uses

from SolarWinds Compromise

Campaign

uses

from Stealth Falcon

Group

uses

from TeamPCP Cloud Stealer

Malware

uses

from Volt Typhoon

Group

uses

Malware

2 external

References

mitre-attack

T1555

F-Secure The Dukes

https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf