Loading malware…
Impacket is a widely used open-source Python toolkit for working with Windows network protocols and remote administration mechanisms. Although it is a legitimate security and development framework rather than malware in itself, it is frequently abused by intrusion operators for post-compromise activity in enterprise Windows environments. Commonly observed uses include remote execution over SMB and related protocols, credential dumping through modules such as SecretsDump, network reconnaissance, internal scanning, NTLM relay operations, and lateral movement between hosts, including domain controllers.
The toolkit is regularly seen in hands-on-keyboard intrusions conducted by a broad range of actors, including state-linked espionage groups and ransomware affiliates. Reported examples include use by APT10 during intrusions into Taiwan’s financial sector, by Black Basta operators during social-engineering-led compromises, by Storm-0501 for credential dumping, by actors associated with Warlock ransomware deployment, and in post-compromise activity following exploitation of edge appliances such as Citrix, Palo Alto Networks, and Check Point remote-access infrastructure. In these operations, Impacket is often paired with credential theft tools, remote service creation, WMI, PsExec-like tradecraft, and other administrative utilities to expand access and prepare for exfiltration or ransomware deployment.
Impacket primarily targets Windows-centric enterprise networks because its most abused capabilities rely on Windows authentication, SMB, RPC, Remote Registry, Service Control Manager, and related Active Directory-adjacent protocols. Its operational role is best characterized as post-exploitation tooling used for credential access, reconnaissance, and lateral movement rather than as a self-propagating payload or standalone malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Post-exploitation : Impacket , attaques NTLM relay, mouvement latéral
A working proof-of-concept (PoC) exploit has been released for a new NTLM reflection bypass flaw that enables SYSTEM-level access on Windows Server 2025. The vulnerability, tracked as CVE-2026-24294, abuses a feature introduced in Windows 11 24H2 and Windows Server 2025 that allows SMB connections over arbitrary TCP ports.
Impacket is a versatile, dual-use tool that uses Python-based scripts to exploit legitimate Windows services and protocols... threat actors frequently use psexec.py, smbexec.py, and wmiexec.py scripts within Impacket to execute code remotely on Windows systems without additional payloads or tools.
51 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
User credentials are gained through a variety of different means including exploitation of public-facing appliances, insecurely stored credentials, extracting the Active Directory database file (NTDS.dit), enumerating existing stored sessions, credential dumping through LSASS, and use of the Mimikatz and Impacket tools
APT10 exploited a vulnerability in the web interface of a security tool, planted a version of the ASPXCSharp web shell, and then used a tool called Impacket to scan a target company's internal network.
Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Impacket activity was detected in the organization’s network, indicating its use of Windows network protocol interactions. The observed command lines align with Impacket's smbexec script, enabling a semi-interactive shell via SMB.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The earliest evidence of compromise was a secretsdump from an unidentified endpoint of the targeted organization to one of the domain controllers.
When opened, the HTML file triggered a system connection attempt to a Server Message Block (SMB) server via a meta refresh to a file scheme URI ending in .txt.
powershell.exe Get-NetUser 1> \\127.0.0.1\ADMIN$\<impacket_log_file> 2>&1 User Discovery [T1033]
Microsoft stated that the threat actors used Impacket tools to execute the malware.
It was followed by the execution of discovery commands using wmiexec in the context of the built-in domain administrator account.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
96 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as an example string for query-language starts-with-any matching; no malicious use or specific activity is discussed.
Offensive post-exploitation toolkit used to interact with compromised systems and extract data.
Offensive post-exploitation toolkit used after VPN compromise for lateral movement, protocol abuse, configuration retrieval, and tunnel establishment.
Framework used post-compromise for lateral movement and NTLM relay abuse.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.