Loading malware…
Impacket is an open-source Python toolkit for working with network protocols that is widely used in offensive security and frequently abused by threat actors during post-compromise operations. It is not a conventional self-propagating malware family; rather, it is a dual-use toolset that provides modules and scripts for remote command execution, credential access, reconnaissance, and lateral movement in Windows and Active Directory environments. Commonly abused components include smbexec, wmiexec, psexec-style functionality, secretsdump, and RPC- and SMB-based capabilities that enable operators to interact with remote systems, create services, execute commands, and extract secrets such as SAM, LSA, NTDS, and replication-derived credential material.
Impacket has been observed across a wide range of intrusions, including ransomware, espionage, and initial-access-broker activity. Reported users include groups and clusters such as menuPass, Storm-1175, Storm-2603, UAT-8837, VOID MANTICORE, Elephant Beetle, and multiple actors involved in Warlock and Medusa-linked operations. It is commonly used after initial access obtained through exploited public-facing applications, stolen credentials, compromised VPN or Citrix sessions, or web shell deployment. In these intrusions, operators typically use Impacket to move laterally between Windows hosts and domain controllers, execute commands through SMB or WMI, dump credentials remotely, and support broader hands-on-keyboard activity.
The toolkit is especially associated with Windows enterprise environments because it abuses native administrative protocols and Active Directory mechanisms. Its capabilities support reconnaissance, credential theft, lateral movement, and post-exploitation, and it is often paired with tools such as Mimikatz, PsExec, BloodHound, Rclone, and remote management software. Defenders and vendors frequently track Impacket activity as a strong indicator of adversary tradecraft in enterprise intrusions, particularly where RPC, SMB admin shares, WMI, remote service creation, or DCSync-style credential access are involved.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A working proof-of-concept (PoC) exploit has been released for a new NTLM reflection bypass flaw that enables SYSTEM-level access on Windows Server 2025. The vulnerability, tracked as CVE-2026-24294, abuses a feature introduced in Windows 11 24H2 and Windows Server 2025 that allows SMB connections over arbitrary TCP ports.
Arctic Wolf observed a wave of CVE-2026-0257 exploitation activity in late May and early June 2026... CVE-2026-0257 is an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access.
Impacket is a versatile, dual-use tool that uses Python-based scripts to exploit legitimate Windows services and protocols... threat actors frequently use psexec.py, smbexec.py, and wmiexec.py scripts within Impacket to execute code remotely on Windows systems without additional payloads or tools.
50 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For Managed Services, menuPass used a suite of malware including Sigloader, P8RAT, FYAnti, Impacket, and QuasarRat.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Impacket activity was detected in the organization’s network, indicating its use of Windows network protocol interactions. The observed command lines align with Impacket's smbexec script, enabling a semi-interactive shell via SMB.
When compromising Windows Domain Controllers servers, the group harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised DC to locally decrypt it.
During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.
Additionally, Storm-1175 has leveraged Impacket for lateral movement. Impacket is a collection of open-source Python classes designed for working with network protocols, and it is popular with adversaries due to ease of use and wide range of capabilities.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Suppose that we have a TGT for the machine account min-frperso-01$.minus.sub.frperso.local... we can obtain administrative access to its network share.
Suppose that we have a TGT for the machine account min-frperso-01$.minus.sub.frperso.local... we can obtain administrative access to its network share.
Step 2: Configure RBCD on target Computer Account ... Set-DomainObject -Set @{ 'msds-allowedtoactonbehalfofotheridentity' = $SDBytes }
The selection of the Default Domain Policy ({31B2F340–016D-11D2–945F-00C04FB984F9}) is deliberate. This is the default Group Policy Object (GPO) applied to all objects within the domain, ensuring that the payload is executed on every system joined to the victim’s pokka.local domain.
The selection of the Default Domain Policy ({31B2F340–016D-11D2–945F-00C04FB984F9}) is deliberate. This is the default Group Policy Object (GPO) applied to all objects within the domain, ensuring that the payload is executed on every system joined to the victim’s pokka.local domain.
Этап 4 - DCSync (T1003.006, Credential Access). С привилегиями SYSTEM на DC выполняем DCSync через secretsdump.py (Impacket) или mimikatz lsadump::dcsync /all - получаем NTLM-хеши всех учётных записей домена, включая krbtgt.
CVE-2025-33073 reintroduced NTLM reflection as a powerful attack vector, allowing an attacker to coerce a Windows host into authenticating to an attacker-controlled service and then relaying that authentication back to the same machine to gain SYSTEM privileges. | The attacker captures this privileged NTLM authentication and relays it back to the real SMB service on the host using a relay tool such as Impacket’s ntlmrelayx, resulting in a SYSTEM-authenticated SMB session and full local compromise.
They request a Kerberos Ticket (TGT) for the dMSA... Because the state is “Completed,” the KDC follows a new rule built into Windows Server 2025: “If a migration is complete, the successor (dMSA) should act as the predecessor (Admin).”
Golden Ticket Attacks : If an attacker obtains the KRBTGT account's password hash, they can forge TGS for any user in the domain, including Domain Admins, providing complete and persistent domain control.
If you want to probe RPC remotely, the data set we can get is dramatically reduced. There are literally two options: query the Endpoint Mapper service or brute force UUIDs of known interfaces and then their methods by OpNum. | We can query the EpMapper service and find out the endpoints on which specific RPC interfaces are running... RpcMgmtEpEltInqBegin() to begin examining the list of endpoints from EpMapper and RpcMgmtEpEltInqNext() to get the next element of the list.
In the most progressed case, the operator used PsExec, Impacket-based tooling and Mimikatz for lateral movement and credential access
The script uses the Impacket framework to establish an SMB connection to the Domain Controller.
I suggest uploading the file via nxc and launching it via dcomexec with the -nooutput flag. ... impacket-dcomexec.py -nooutput admin : admin @10.10.10.10 "c:\rpcmotion.exe"
CVE-2025-33073 reintroduced NTLM reflection as a powerful attack vector, allowing an attacker to coerce a Windows host into authenticating to an attacker-controlled service and then relaying that authentication back to the same machine to gain SYSTEM privileges. | The attacker captures this privileged NTLM authentication and relays it back to the real SMB service on the host using a relay tool such as Impacket’s ntlmrelayx, resulting in a SYSTEM-authenticated SMB session and full local compromise.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
87 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Offensive tooling used against domain controllers for remote execution and follow-on activity during the intrusion.
Набор постэксплуатационных инструментов; в тексте упомянут модуль smbexec для подключения к ADMIN$ по SMB, копирования бинаря и его запуска на удалённой системе.
A post-exploitation toolkit used for hands-on-keyboard attacks, credential dumping, and lateral movement over Windows protocols including RPC.
Referenced through detection names as part of the toolset associated with the threat activity, likely for remote execution, credential abuse, or lateral movement in Windows environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.