Role
Incident response and threat hunting
Follow an alert to the actor behind it, with indicators, techniques and leaked access in one place, so a review starts from facts.
Read more
Malware profile
Mimikatz
Mimikatz is a tool that pulls Windows account logins and passwords out of a computer.
In short
Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. MITRE describes it as a credential dumper that is also useful for testing the security of networks. The UK NCSC says it was not originally meant as a hacking tool, but hostile actors now use it widely once they have access to a host.
- Names2names in public reportsMimikatz · Invoke-Mimikatz
- Techniques16ATT&CK techniques listedCredential Access · Lateral Movement · Persistence
- Infection Steps4in the delivery chainAttacker gets access · Local admin rights
- Linked Groups16groups that use itAPT1 · APT28 · APT29
In one minute
- What it is
- A public credential dumping tool for Windows that pulls account logins and passwords out of a computer.
- What it does
- Takes passwords and hashes from memory and other stores, forges Kerberos tickets and reuses stolen hashes to sign in as other users.
- Who uses it
- Attributed by CISA and partners: Volt Typhoon (advisory of 7 February 2024), Scattered Spider (advisory first published 16 November 2023) and Medusa ransomware actors (advisory AA25-071A). MITRE lists many more groups.
- How it gets in
- Run by an attacker who already has access to a host, usually with admin rights, as the NCSC describes.
- What to do first
- Disable clear text password storage in LSASS memory, turn on credential protection such as Credential Guard, and treat any Mimikatz detection as a live intrusion.
What it does
The NCSC says Mimikatz source code is publicly available, so anyone can compile their own version and add new plug-ins. It says the tool is bundled into other penetration testing suites, and that many of its features can be automated with scripts.
The NCSC also says that once an attacker has local admin rights on a host, Mimikatz can get the hashes and clear-text passwords of other users. It can only capture accounts that are logged in to the machine it runs on. When it runs in memory through the ‘Invoke-Mimikatz’ PowerShell script, the NCSC says its activity is very difficult to isolate and identify.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Mimikatz | MITRE ATT&CK software S0002 and the NCSC joint report on publicly available hacking tools[1, 2] |
| Invoke-Mimikatz | PowerShell script that runs Mimikatz in memory, named in the NCSC joint report[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Credential Access
OS Credential Dumping: LSASS Memory T1003.001
Takes account and password data from the LSASS process memory. The NCSC says this is what the tool is best known for.[1, 2]
OS Credential Dumping: Security Account Manager T1003.002
Takes credentials from the local SAM account store.[1]
OS Credential Dumping: LSA Secrets T1003.004
Takes credentials from the LSA secrets store.[1]
OS Credential Dumping: DCSync T1003.006
Can take credential data using DCSync.[1]
Credentials from Password Stores T1555
Takes credentials from Windows password stores.[1]
Credentials from Password Stores: Windows Credential Manager T1555.004
Can get saved credentials out of Windows Credential Manager.[1]
Steal or Forge Kerberos Tickets: Golden Ticket T1558.001
Its Kerberos module can create golden tickets. The NCSC also says it can build them.[1, 2]
Steal or Forge Kerberos Tickets: Silver Ticket T1558.002
Its Kerberos module can create silver tickets.[1]
Steal or Forge Authentication Certificates T1649
Its CRYPTO module can create and export different types of authentication certificates.[1]
Unsecured Credentials: Private Keys T1552.004
Its CRYPTO::Extract module can extract keys by calling Windows cryptographic functions.[1]
Lateral Movement
Persistence
Defense Impairment
How it spreads
The NCSC says Mimikatz is typically used once an attacker has already gained access to a host and wants to move through the internal network. CISA describes one confirmed Volt Typhoon case where the actor used RDP to connect to a server and ran Mimikatz after using a compromised administrator account to deploy it. The NCSC says Mimikatz was used in the 2017 NotPetya and BadRabbit attacks to extract administrator credentials, which were then used for lateral movement and let the ransomware spread.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Attacker gets access
The attacker first gains access to a host, by other means.[2]
Local admin rights
With local admin rights on the host, Mimikatz can be run. In one CISA case, the actor used RDP to reach a server and ran it after using a compromised administrator account to deploy it.[2, 4]
Credentials taken
Mimikatz gets the hashes and clear-text credentials of other users from memory.[2]
Credentials reused
The stolen credentials let the attacker raise privileges in the domain and move to other machines.[2]
Timeline
- 2007
Mimikatz developed
The NCSC report says Mimikatz was developed in 2007.[2]
- 2011
DigiNotar compromise
The NCSC report says unknown hackers used Mimikatz to get administrator credentials from the Dutch certificate authority DigiNotar.[2]
- 2017
NotPetya and BadRabbit
The NCSC report says Mimikatz was used with other tools in the 2017 NotPetya and BadRabbit ransomware attacks to extract administrator credentials.[2]
- 11 October 2018
Joint report on hacking tools
The NCSC published a joint report from agencies of five nations that covers Mimikatz.[3]
- 23 September 2022
Albania advisory
CISA and the FBI published an advisory on Iranian state actors' operations against the Government of Albania. It says the FBI found evidence of Mimikatz usage and LSASS dumping.
- 24 May 2023
Volt Typhoon advisory
CISA and partners published AA23-144A on a PRC state-sponsored actor also known as Volt Typhoon. It lists mimikatz.exe among commands used to look for more credentials.[5]
- 16 November 2023
Scattered Spider advisory
CISA and partners first published AA23-320A. The current version lists Mimikatz in its table of tools used by Scattered Spider.[6]
- 7 February 2024
PRC actors in critical infrastructure
CISA and partners published AA24-038A. It says US agencies have observed Volt Typhoon actors using Mimikatz to harvest credentials.[4]
- 18 August 2026
Medusa advisory updated
CISA and partners updated AA25-071A, first published 12 March 2025. It says Medusa actors use Mimikatz for LSASS dumping.[7]
Who uses it
- Ransomware group 8Base 8Base is the name of a ransomware affiliate group that used the Phobos ransomware. Disrupted · Since 2019 · Ransomware affiliate group using Phobos (Phobos itself is a ransomware as a service)
- Threat group APT1 Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. China · Since 2006
- Threat group APT28 The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). Russia · Since 2004
- Threat group APT29 The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). Russia · Since 2008
- Threat group APT33 MITRE ATT&CK describes APT33 as a suspected Iranian threat group active since at least 2013, with a particular interest in aviation and energy in the United States, Saudi Arabia and South Korea. Iran · Since 2013
- Threat group APT34 MITRE ATT&CK describes OilRig, also tracked as APT34, as a suspected Iranian group working on behalf of the Iranian government since at least 2014, and the UAE Cyber Security Council issued advisories on it in October and December 2024. Iran · Since 2014
- Threat group APT38 APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. North Korea · Since 2014
- Threat group APT39 The US Treasury, FBI and Department of Justice attributed APT39, also called Chafer, to Iran's Ministry of Intelligence and Security (MOIS), working through the front company Rana Intelligence Computing Company, in September 2020. Iran · Since 2014
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Threat group Kimsuky Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to think tanks, researchers, media and government staff to steal documents and email. North Korea · Since 2012
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Threat group menuPass Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers. China · Since 2006
- Threat group MuddyWater Attributed by MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury to Iran's Ministry of Intelligence and Security (MOIS), this group is described as running cyber espionage against telecommunications, defense, local government and oil and gas organizations. Iran · Since 2017
- Threat group Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. China · Since 2012
- Ransomware group Play Play, also called Playcrypt, is a ransomware group active since June 2022. Active · Since 2022 · Closed group (presumed, per the advisory)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group Royal Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit. Rebranded · Since 2022 · Not stated as ransomware as a service in the sources; operated by the group itself
- Threat group Sandworm Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016 power grid attacks in Ukraine, the 2017 NotPetya attack and the 2018 Winter Olympics attack. Russia · Since 2009
- Threat group Scattered Spider Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA. Not attributed to a state · Since 2022
- Threat group Turla Attributed by MITRE ATT&CK to Russia's FSB, Turla has run espionage against governments, embassies and the military since at least 2004. Russia · Since 2004
- Threat group Volt Typhoon Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described in US advisories as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis. China · Since 2021
- Ransomware group Warlock Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. Since 2025 · Not stated by the sources
Seen in
- Incident HSE Conti ransomware attack In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service. May 2021 · Healthcare
- Incident Kyiv substation attack with Industroyer On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities
- Incident SharePoint ToolShell attacks In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. July 2025 · Multiple sectors
Detection and defense
Treat a detection as an intrusion
The NCSC says antivirus tools detect unmodified Mimikatz, but attackers can run it in memory or change the code. Where it is found, investigate fully. CISA's guide lists AD enumeration and LSASS dumping, for example by Mimikatz, as signs to hunt for.[2]
Counters: T1003.001
Questions
What is Mimikatz?
MITRE describes it as a credential dumper that can get plaintext Windows account logins and passwords, and is also useful for testing the security of networks.
Was Mimikatz made for hacking?
The NCSC says it was not originally intended as a hacking tool. It also says hostile actors, including organized crime and state-sponsored groups, widely use it.
Who has used Mimikatz?
MITRE lists many groups. CISA and partners describe use by Volt Typhoon, by Scattered Spider and by Medusa ransomware actors. CISA's advisory on attacks on Albania says the FBI found evidence of Mimikatz usage.
Can antivirus stop Mimikatz?
The NCSC says most up-to-date antivirus tools detect non-customized use, but attackers can sometimes get around them by running it in memory or changing the code.
How do you reduce the damage?
The NCSC says to disable clear text password storage in LSASS memory, use Credential Guard where possible, limit admin accounts and avoid password reuse. Any detection should be treated as an active intruder.
In our research
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- What Is Triple Extortion? The Anatomy of the Encryption + Leakage + DDoS Trio April 2026
- Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape March 2026
- TA577 (Hive0118): The Evolving Phishing Specialist Behind Modern Malware Campaigns January 2026
Sources
- Mimikatz, Software S0002 MITRE ATT&CKSupports: Description, platform, techniques and groups listed for Mimikatz.
- Joint report on publicly available hacking tools (PDF) NCSC UK with partner agencies of Australia, Canada, New Zealand and the USSupports: Development year, use, past incidents, capabilities and defence advice.
- Joint report on publicly available hacking tools NCSC UKSupports: Publication date of 11 October 2018.
- PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A) CISA and partnersSupports: Volt Typhoon use of Mimikatz, the RDP case, mitigations and indicators.
- People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection (AA23-144A) CISA and partnersSupports: mimikatz.exe listed among commands used, and indicators in STIX format.
- Scattered Spider (AA23-320A) CISA, FBI and partnersSupports: Mimikatz listed among tools used by Scattered Spider.
- Iranian State Actors Conduct Cyber Operations Against the Government of Albania (AA22-264A) CISA and FBISupports: FBI evidence of Mimikatz usage and LSASS dumping.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.