MimikatzTool
Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks.From MITRE ATT&CK
Last reported yesterday, by The Hacker News52 reports
ATT&CK techniques
6 of 143 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1110Brute Force
“…Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.”
- T1021.001Remote Desktop Protocol
“They also employ Remote Desktop Protocol (RDP) [T1021.001, T1133] to expand their presence within the compromised network [T1021].”
- T1543.003Windows Service
“k0t made extensive use of NetExec’s built-in smbexec (which uses the Windows Service Control Manager over SMB) execution method for remote execution”
- T1550.002Pass the Hash
“Still, in the lab, it reached NT AUTHORITY\SYSTEM, recovered domain-admin credentials from LSASS, and moved laterally via pass-the-hash.”
- T1003OS Credential Dumping
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
52 reports · the newest 20, newest first · the exact sentence from each-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“…d by the use of legitimate administrator and pentesting utilities like NetExec, SoftPerfect, Impacket, noPac, Kerbrute, PetitPotam, and Mimikatz to burrow deeper into victims' corporate environments.”
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations“Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access.”
-
The Science of Exploitability: Decoding BlueHammer“In our lab setup, we used the SYSTEM shell to retrieve sensitive data from LSASS with Mimikatz.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“Mimikatz – Seen used to dump cleartext passwords and NTLM hashes from LSASS.”
-
#StopRansomware: SafePay Ransomware“Mimikatz”
-
AI Decision Models and Their Impact on AI SOC Platforms“The most common families we found in memory last year were tools like Mimikatz, Meterpreter and Cobalt Strike.”
-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“The exposed infrastructure contained 17 named post-exploitation tools, including credential-dumping scripts, Mimikatz output, SQL credential-testing utilities, and file-transfer tooling.”
-
The First 24 Hours: What Happens When Ransomware Lands“CISA's advisory documents Akira operators dumping credentials with Mimikatz and LaZagne, pulling them from LSASS memory, and running Kerberoasting against service accounts.”
-
The Fine Art of Frustrating the Adversary“They might use Mimikatz, comsvcs.dll, direct access to LSASS memory, a custom utility or another implementation entirely.”
-
Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware“Windows Task Manager Mimikatz is used to harvest credentials, including stealing them directly from the LSA authentication mechanism, which allows them to record plaintext passwords to a log file.”
-
The untold story of incident response: A Christmas Miracle“…cript was identified in the event journal, purposed for dumping “lsass.exe” in order to potentially extract credentials with tools like Mimikatz.”
-
APT41 World Tour 2021 on a tight schedule“To dump the LSASS process, the threat actors used the utilities Procdump and Mimikatz.”
-
REvil Twins: Ransomware-as-a-Service program“This allowed affiliates to use very common and easy-detectable tools for credential dumping, such as Mimikatz and LaZagne.”
-
ATT&CKing ProLock Ransomware“…ogging capabilities but is also able to download and run additional scripts like Invoke-Mimikatz, a PowerShell version of the notorious Mimikatz.”
-
Reconstructing User Activity for Forensics with FeatureUsage“Evidence of Mimikatz execution”
-
No Time to Waste“As can be seen in the screenshot, the attackers installed TeamViewer (a file from a file sharing website called sendspace.com) and Mimikatz on the victim’s computer.”
-
NotPetya pulls BadRabbit out of the hat“Mimikatz.”
-
BadRabbit: spread of new cryptolocker“As identified, it users Mimikatz to collect logins and passwords on the infected machine and also uses credentials libraries to gain admin rights.”
-
Secrets of Cobalt“…includes a keylogger, screenshots, remote access via VNC, injections into processes, the ability to bypass the UAC security system, the Mimikatz tool, which is used to compromise access credentials for Windows OS accounts, the ability to scan open ports on an organization’s compu…”
-
Targeted attacks on banks“For instance, a source code of such a tool, Mimikatz, has been posted on a website and is currently available for everyone.”
Indicators in its reports
named in the reports above- 185.149.120[.]3in 2 reports
- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
Copy these 8 indicators · defanged
Thanks — we review every report.