For this method, Ransom Cartel uses a tool named ""DonPAPI,"" which can search hosts for DPAPI blobs containing Wi-Fi keys, RDP passwords, and credentials saved in web browsers and then download and decrypt them locally on the machine.