Plain Text Passwords: The Risks of Storing Them

What it is

A Huntress SOC incident writeup (APAC region) showing an Akira intrusion where a plaintext Huntress_recovery_codes-<redacted>.txt file on a security engineer's desktop let the attacker log into the victim's own Huntress portal and turn the EDR against itself. The summary already has the arc (SonicWall → Akira → recovery codes → MFA bypass → closing incidents/uninstalling agents → certutil export). What it does not carry is the concrete command-level detail and the detection sequence, below.

How it works — the specifics the summary omits

The detection did not start with the portal login. Huntress SOC first caught multiple admin accounts deleting shadow copies across hosts and fired a mass isolation response — which is what stopped full-environment encryption; the Akira binary w.exe running from a desktop only encrypted the one workstation.

Attacker hosts came in over the SonicWall VPN on 192.168.x.x DHCP addresses with no Huntress agent installed, so they were invisible to EDR and blended with internal traffic — the reason lateral movement didn't trip anomaly detection.

The recovery-code file was read remotely over SMB from the DC:

"C:\windows\system32\NOTEPAD.EXE" \\192.168.1.51\c$\Users\<redacted>\Desktop\Huntress_recovery_codes-<redacted>.txt

Certificate theft from the DC's personal store (potential cert-based auth impersonation, e.g. VPN/RDP):

certutil -store My
certutil -exportPFX 1d967729be08ef8c4bf86874c9542b4e C:\temp\cert.pfx
certutil -exportPFX 1d967729be08ef8c4bf86874c9542b4e C:\cert.pfx

The PFX export includes the private key. Certificate thumbprint: 1d967729be08ef8c4bf86874c9542b4e. Portal login came from malicious IP 104.238.221[.]69, already tied to other SonicWall compromises. Root cause of the cert activity was never determined.

What to do

Beyond the summary's hash/salt guidance, the page adds two storage-specific items:

• Encrypt offline storage if you can't use a manager: codes in an encrypted, password-protected file on an encrypted USB/disk.
• Rotate and monitor: regenerate recovery codes periodically; watch for unusual portal logins.

Treat recovery codes as privileged credentials — they bypass MFA with no secondary challenge, making a plaintext copy a single point of failure. Detection hooks worth building from this incident: shadow-copy deletion across multiple hosts, certutil -store/-exportPFX on a DC, and SMB reads of files matching *recovery_codes*.txt on admin share paths.

Caveats

Huntress markets its Managed ITDR here (identity attack response "in around three minutes," false-positive rate "under 5%") — vendor figures, not independently verified. The linked SonicWall CVE is not named in this post; it references a separate "Active Exploitation of SonicWall VPNs" advisory for the initial-access detail.