สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Windows Credentials Editor

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Windows Credentials Editor

Names	Windows Credentials Editor Windows Credential Editor WCE
Category	Tools
Type	Credential stealer
Description	Windows Credentials Editor (WCE) is a security tool to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes, plaintext passwords and Kerberos tickets).
Information	<https://www.ampliasecurity.com/research/windows-credentials-editor/>
MITRE ATT&CK	<https://attack.mitre.org/software/S0005/>

Last change to this tool card: 30 December 2022

Download this tool card in JSON format

All groups using tool Windows Credentials Editor

Changed	Name	Country	Observed
APT groups
	Bronze Butler, Tick, RedBaldNight, Stalker Panda		2006-Apr 2021
	Chafer, APT 39		2014-Sep 2020
	Emissary Panda, APT 27, LuckyMouse, Bronze Union		2010-Aug 2023
	FIN5	[Unknown]	2008
	FIN6, Skeleton Spider	[Unknown]	2015-Oct 2021
	Gallium		2018-Jun 2022
	Leviathan, APT 40, TEMP.Periscope		2013-Jul 2021
	Suckfly		2014-Late 2015
	Turla, Waterbug, Venomous Bear		1996-Dec 2023

9 groups listed (9 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]