S0357 Impacket

toolEnterprise

platformsLinux · macOS · Windows

also known asImpacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.

techniques used (11)

ATT&CK techniques this enables or maps to.

T1003.001LSASS Memory
T1003.002Security Account Manager
T1003.003NTDS
T1003.004LSA Secrets
T1040Network Sniffing
T1047Windows Management Instrumentation
T1557.001Name Resolution Poisoning and SMB Relay
T1558.003Kerberoasting
T1558.005Ccache Files
T1569.002Service Execution
T1570Lateral Tool Transfer

used by groups (18)

Threat groups associated with this.

G0016APT29
G0096APT41
G1021Cinnamon Tempest
G0035Dragonfly
G1003Ember Bear
G1016FIN13
G0061FIN8
G0125HAFNIUM
G0030Lotus Blossom
G0059Magic Hound
G0129Mustang Panda
G0034Sandworm Team
G1053Storm-0501
G1046Storm-1811
G0027Threat Group-3390
G1047Velvet Ant
G1017Volt Typhoon
G0045menuPass

used by campaigns (6)

Campaigns that use this.

C00632025 Poland Wiper Attacks
C0027C0027
C0029Cutting Edge
C0038HomeLand Justice
C0014Operation Wocao
C0058SharePoint ToolShell Exploitation

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan