OS Credential Dumping (T1003): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1003.
- Tactical Phase: Credential Access.
- Substantiated in 9 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (9)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
"The malware harvested passwords from computer memory using a bundled Mimikatz variant to impersonate network administrators."
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Operators created volume shadow copies on domain controllers to extract the Active Directory database (ntds.dit) and SYSTEM registry hives, enabling offline password cracking.
U.S. v. Baratov et al. (Yahoo 2014 Breach / FSB Officers)
Conspiracy between Russian Federal Security Service (FSB) officers and criminal hackers to breach Yahoo's network, compromising 500 million user accounts to conduct espionage against journalists, government officials, and commercial executives.
"Adversaries stole Yahoo's proprietary user database containing names, email addresses, cryptographic salts, and hashed passwords."
U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)
Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.
"Injected modular credential harvesters that pulled domain credentials from Windows memory to pave the way for ransomware."
Sony Pictures Entertainment Destructive Wiper Attack
North Korean state-sponsored operators infiltrated Sony Pictures Entertainment, deploying destructive Shamoon/Destover wipers that permanently erased thousands of servers and workstations, exfiltrating terabytes of unreleased films, employee SSNs, and executive emails.
"Operators deployed custom credential dumpers to extract Active Directory hashes and plaintext administrative passwords from compromised system memory."
U.S. v. Fujie Wang et al. (Anthem 78.8M Patient Record Breach)
Chinese state-affiliated threat actors conducted spearphishing campaigns against Anthem health insurance subsidiaries, deploying customized backdoors to penetrate enterprise data warehouses and exfiltrate 78.8 million personal health and identity records.
Adversaries used memory scraping tools to capture credentials of database administrators with access to the enterprise data warehouse.
Marriott Starwood 383 Million Guest Reservation Breach
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.
"Attackers utilized memory-scraping tools and credential harvesting scripts to pull plaintext payment card details before encryption at rest occurred."
Neiman Marcus 1.1 Million Payment Card In-Memory Scraping
Sophisticated memory-scraping malware intrusion into point-of-sale systems across 77 Neiman Marcus luxury department stores, capturing payment card Track 2 data in memory over a four-month stealth campaign, resolved through a multi-state Attorney General consent decree.
"Custom RAM scraper malware monitored process memory of payment gateway applications, copying unencrypted magnetic stripe Track 2 data before encryption."
Home Depot 56 Million Payment Card Breach (BlackPOS Malware)
Historic retail network compromise wherein cybercriminals used stolen third-party HVAC vendor credentials to penetrate Home Depot corporate intranet, deploying custom BlackPOS memory-scraping malware across 2,200 store checkout terminals and exfiltrating 56 million credit and debit card records.
"Custom variant of BlackPOS malware was staged on self-checkout terminals, periodically scraping unencrypted payment card magnetic stripe Track 1 and Track 2 records from memory."
Commonly Charged Criminal Statutes
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.
Conspiracy to Commit Wire Fraud
Applies the same penalties as the underlying substantive wire fraud offense to any person who attempts or conspires to commit wire fraud.
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.