Source: MITRE_ATTCK
Threat actor: MuddyWater
Affected sector: Unknown
Attack vector: Unknown Tactic
Severity: High
Confidence: High
MITRE ATT&CK techniques: T1003.005
Description:
MITRE ATT&CK technique T1003.005 (Cached Domain Credentials) used by MuddyWater. Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)

On Windows Vista...