Loading malware…
XenAllPasswordPro is a Windows credential-harvesting tool used to extract passwords and other authentication data from local credential stores. Its capabilities include recovering credentials saved by Firefox and Thunderbird using Mozilla NSS libraries deployed alongside the tool. Attackers deploy it across multiple endpoints over SMB and execute it remotely through mechanisms such as WMI or RDP during post-compromise credential collection.
XenAllPasswordPro has been used by Crypt Ghouls and Cyber Anarchy Squad. Observed Crypt Ghouls campaigns targeted Russian government agencies and businesses in mining, energy, finance, and retail, while Cyber Anarchy Squad has targeted organizations in Russia and Belarus. The tool serves as a credential-collection component within broader intrusion workflows rather than providing the ransomware, persistence, or remote-access capabilities supplied by other tools in those operations.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“XenAllPasswordPro Mass credential harvesting via SMB; deployment scripting captured verbatim in the leak.” | XenAllPasswordPro mass deployment via SMB.
The attackers employed the XenAllPasswordPro tool to harvest a range of authentication data from the target system.
The attackers employed the XenAllPasswordPro tool to harvest a range of authentication data from the target system.
The attackers employed the XenAllPasswordPro tool to harvest a range of authentication data from the target system.
The attackers employed the XenAllPasswordPro tool to harvest a range of authentication data from the target system.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
FortiGate configuration dumps containing plaintext local-user passwords and LDAP bind credentials are shared in full between affiliates; stolen OWA credentials and stealer logs are also processed.
FortiGate configuration dumps containing plaintext local-user passwords and LDAP bind credentials are shared in full between affiliates; stolen OWA credentials and stealer logs are also processed.
FortiGate configuration dumps containing plaintext local-user passwords and LDAP bind credentials are shared in full between affiliates; stolen OWA credentials and stealer logs are also processed.
FortiGate configuration dumps containing plaintext local-user passwords and LDAP bind credentials are shared in full between affiliates; stolen OWA credentials and stealer logs are also processed.
XenAllPasswordPro mass deployment via SMB.
NetExec with forced share creation via PowerShell.
LimeWire staging URLs for tooling distribution ... Payloads hosted on temp.sh/0x0.st via G-BOT builder.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.