Network Service Discovery

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.^[4]

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.^[5][6]

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.^[7]

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.^[8]

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.^[9]

BADHATCH can check for open ports on a computer by establishing a TCP connection.^[10]

BlackEnergy has conducted port scans on a host.^[11]

BlackTech has used the SNScan tool to find other potential targets on victim networks.^[12]

Brute Ratel C4 can conduct port scanning against targeted systems.^[13]

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.^[14]

During C0027, used RustScan to scan for open ports on targeted ESXi appliances.^[15]

Caterpillar WebShell has a module to use a port scanner on a system.^[16]

Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.^[17]

China Chopper's server component can spider authentication portals.^[18]

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.^[19][20][21]

Cobalt Strike can perform port scans from an infected host.^[22][23][24]

Conficker scans for other machines to infect.^[25]

During CostaRicto, the threat actors employed nmap and pscan to scan target environments.^[26]

DarkVishnya performed port scanning to obtain the list of active services.^[27]

Empire can perform port scans from an infected host.^[28]

FIN13 has utilized nmap for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.^[29][30]

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[31]

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.^[32][33]

HDoor scans to identify open ports on the victim.^[34]

HermeticWizard has the ability to scan ports on a compromised network.^[35]

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.^[36]

Industroyer uses a custom port scanner to map out a network.^[37]

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.^[38]

Koadic can scan for open TCP ports on the target network.^[39]

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.^[40]

Leafminer scanned network services to search for vulnerabilities in the victim system.^[41]

Lucifer can scan for open ports including TCP ports 135 and 1433.^[42]

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.^[43]

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.^[44]

MURKYTOP has the capability to scan for open ports on hosts in a connected network.^[18]

Naikon has used the LadonGo scanner to scan target networks.^[45]

NBTscan can be used to scan IP networks.^[46][47]

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.^[48]

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.^[49]

P.A.S. Webshell can scan networks for open ports and listening services.^[50]

Peirates can initiate a port scan against a given IP address.^[51]

PoshC2 can perform port scans from an infected host.^[52]

Pupy has a built-in module for port scanning.^[53]

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.^[54]

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.^[55][56]

Remsec has a plugin that can perform ARP scanning as well as port scanning.^[57]

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.^[58][59]

Royal can scan the network interfaces of targeted systems.^[60]

SILENTTRINITY can scan for open ports on a compromised machine.^[61]

SpeakUp checks for availability of specific ports on servers.^[62]

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.^[63]

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.^[64][36][65] TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.^[66]

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.^[67][68]

Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.^[69][70]

Xbash can perform port scanning of TCP and UDP ports.^[71]

XTunnel is capable of probing the network for open ports.^[72]

ZxShell can launch port scans.^[7][73]

Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Use network intrusion detection/prevention systems to detect and prevent remote service scans.

Ensure proper network segmentation is followed to protect critical servers and devices.