OxideHarvest

OxideHarvest is a Rust-based credential-stealing malware tool associated with a Gentlemen ransomware affiliate, particularly the operator tracked as quant, and also known by the alias buildx641. It is used as part of post-compromise collection activity rather than as a core payload of the Gentlemen operators themselves. The malware is designed to harvest credentials and related data from Chromium-based and Gecko-based web browsers on compromised Windows systems. Reported targets include major Chromium-family browsers and Firefox-derived browsers, indicating broad coverage of stored browser secrets across enterprise and consumer environments.

Available reporting characterizes OxideHarvest as a credential stealer that accepts runtime parameters including connection and output options, then extracts browser-stored data for operator use. In addition to browser credential harvesting, it has been described in intrusion activity as a custom credential and data collector leveraging shadow-copy access and extraction of Active Directory credential material, including NTDS and SYSTEM hive data, indicating utility in both local credential theft and domain-focused post-exploitation. The malware has been linked to ransomware intrusion workflows in which stolen credentials support follow-on privilege escalation, lateral movement, and broader compromise objectives.

OxideHarvest is not assessed to be an in-house Gentlemen development; instead, it is attributed to an affiliate-maintained tool integrated into that ecosystem. Its observed role aligns with credential access and collection during ransomware operations targeting organizational environments.