Windows Credentials Editor - Threat Group Cards: A Threat
Actor Encyclopedia
Archived: 2026-04-05 19:27:37 UTC
Home > List all groups > List all tools > List all groups using tool Windows Credentials Editor
 Tool: Windows Credentials Editor
Names
Windows Credentials Editor
Windows Credential Editor
WCE
Category Tools
Type Credential stealer
Description
Windows Credentials Editor (WCE) is a security tool to list logon sessions and add,
change, list and delete associated credentials (ex.: LM/NT hashes, plaintext passwords
and Kerberos tickets).
Information MITRE ATT&CK Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool Windows Credentials Editor
Changed Name Country Observed
APT groups
 Bronze Butler, Tick, RedBaldNight, Stalker Panda 2006-Apr 2021
 Chafer, APT 39 2014-Sep 2020
 Emissary Panda, APT 27, LuckyMouse, Bronze Union 2010-Aug 2023
 FIN5 [Unknown] 2008
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=80139ef6-2f4b-480e-8f45-f5cad853fa8d
Page 1 of 2

FIN6, Skeleton Spider [Unknown] 2015-Oct 2021
  Gallium 2018-Jun 2022  
  Leviathan, APT 40, TEMP.Periscope 2013-Jul 2021
  Suckfly 2014-Late 2015  
  Turla, Waterbug, Venomous Bear 1996-2024  
9 groups listed (9 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=80139ef6-2f4b-480e-8f45-f5cad853fa8d
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=80139ef6-2f4b-480e-8f45-f5cad853fa8d
Page 2 of 2