Masscan

masscan is a high-speed network scanning tool used to identify exposed services across large IP ranges. In the provided reporting, it is repeatedly used by threat actors for reconnaissance and worm-like propagation rather than as a standalone malicious payload. Observed uses include scanning actor-supplied IP ranges for exposed Docker daemons on ports 2375 and 2376, often paired with zgrab to validate responses such as /v1.16/version before reporting vulnerable targets back to command-and-control infrastructure. It is also described being used to scan for internet-exposed RDP services on port 3389 and internal/private network ranges for SSH services on port 22. The content links its use to multiple campaigns, including a June 2023 cloud credential theft operation with overlaps to TeamTNT tradecraft targeting exposed Docker services in AWS, Azure, and GCP environments; a TOR-enabled cryptojacking campaign targeting misconfigured Docker APIs and propagating via port 2375 scanning; PARINACOTA human-operated ransomware activity using Masscan.exe for RDP target discovery; and 8220 gang activity using masscan for SSH reconnaissance and lateral movement in containerized/cloud environments. Mentioned artifacts include Masscan.exe and masscan_1.3.0.exe. The content does not describe masscan itself as malware, but as a legitimate scanner abused by threat actors for reconnaissance, target discovery, and propagation.