Advanced IP Scanner

Advanced IP Scanner is a legitimate network scanning utility that appears in multiple intrusion and ransomware investigations as an attacker-used discovery and network mapping tool. The provided content specifically describes its use for identifying available network hosts and conducting active scanning. It was observed in operations associated with the hacktivist/destructive group Twelve, alongside tools such as Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, and PsExec, for credential theft, discovery, network mapping, and privilege escalation. In one intrusion tied to exploitation of CVE-2023-46604 on Apache ActiveMQ and subsequent ransomware deployment assessed as LockBit-builder-derived, the attacker used a renamed copy of Advanced IP Scanner masquerading as SoftPerfect Network Scanner during the second intrusion phase before ransomware execution. It was also listed by Field Effect as a tool/file IOC in coordinated Akira ransomware intrusions involving SonicWall SSL VPN access, where attacker tradecraft included network service discovery, lateral movement, staging, attempted exfiltration, and ransomware deployment. High-confidence behavior from the content is limited to host discovery and active network scanning; no malware-specific persistence or payload functionality beyond its use as a scanner is described.