Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 15:41:03 UTC Home > List all groups > List all tools > List all groups using tool GetUserSPNS.vbs Tool: GetUserSPNS.vbs Names GetUserSPNS.vbs Category Malware Type Info stealer Description (Mandiant) In three FIN13 investigations, the threat actors employed a variant of the GetUserSPNS.vbs script to identify user accounts associated with a Service Principal Name that could be targeted for an attack known as “Kerberoasting” to crack the users’ passwords. Information Last change to this tool card: 26 December 2021 Download this tool card in JSON format All groups using tool GetUserSPNS.vbs Changed Name Country Observed APT groups   FIN13 [Unknown] 2016   1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e47fe86d-3a93-4f99-8230-5a291ae1472e https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e47fe86d-3a93-4f99-8230-5a291ae1472e Page 1 of 1