SQL Server Management Studio Password Export Tool
SQL Server Management Studio Password Export Tool is a credential-access utility used to extract the contents of the SSMS file sqlstudio.bin, which stores connection information for Microsoft SQL Server Management Studio (SSMS). In the reported intrusions, attackers deployed it as ssms.exe and used it as part of credential theft and collection activity. Palo Alto Networks Unit 42 observed this tool in operations attributed to CL-UNK-1068, a previously undocumented Chinese-linked intrusion cluster assessed with moderate-to-high confidence to be primarily conducting cyber espionage. The broader campaign targeted organizations across South, Southeast, and East Asia, including telecommunications, energy, technology, pharmaceutical, government, law enforcement, and aviation sectors, and operated across both Windows and Linux environments. Within that toolset, SQL Server Management Studio Password Export Tool was specifically used to extract SSMS connection information from sqlstudio.bin in support of access to SQL-related systems and data.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Other tools powering CL-UNK-1068's credential theft activities include Mimikatz, LsaRecorder, DumpItForLinux, Volatility Framework, and the SQL Server Management Studio Password Export Tool.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used to export/recover stored SQL Server Management Studio credentials as part of credential theft activity.
Tool used to extract saved SQL Server connection information from SSMS (sqlstudio.bin).
Tool used to extract saved SSMS connection credentials from sqlstudio.bin for subsequent exfiltration and lateral movement into SQL environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.