Malware

Advanced Port Scanner

Advanced Port Scanner is a port-scanning and network discovery tool observed in post-compromise activity. In the provided reporting, it was executed as advanced_port_scanner.exe by Iranian state-sponsored actors identifying as HomeLand Justice during the 2022 intrusions against the Government of Albania, where it was used after initial access obtained via exploitation of Microsoft SharePoint CVE-2019-0604 and alongside persistence through ASPX webshells, lateral movement via RDP/SMB/FTP, Exchange compromise, credential harvesting, and destructive follow-on activity including ransomware-style encryption and deployment of a ZeroCleare variant. Separate reporting also lists Advanced Port Scanner among tools used in a coordinated Akira ransomware campaign targeting SonicWall SSL VPN appliances in 2025; that campaign involved initial access via SonicWall SSL VPN, discovery, lateral movement, staging with WinRAR and rclone, attempted exfiltration via SCP and Cloudflare R2, ransomware deployment, and deletion of VSS copies. High-confidence identifiers from the content include the executable name advanced_port_scanner.exe and the alias Advanced Port Scanner.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence2

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

T1027. Obfuscated Files or Information Trigona operators use UPX to pack DC2.exe and DC4.exe to avoid static signature detection. For DC6.exe , Trigona hid the installer for Advanced Port Scanner within Inno Setup installer to evade static signature detection.

T1070.004File DeletionEvidence1

Files pertaining to the threat actor’s post exploitation activities such as reconnaissance of the internal network, were deleted to hinder forensic analysis efforts.

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence2

les outils de reconnaissance réseau Advanced Port Scanner et Advanced IP Scanner de FAMATECH ont été découverts sur le système d’information [T1016].

T1018Remote System DiscoveryEvidence2

LockBit affiliates map the environment before moving further, using Netscan and Advanced Port Scanner to scan the internal network for live hosts, open ports and potential targets.

T1046Network Service DiscoveryEvidence25

using Netscan and Advanced Port Scanner to scan the internal network for live hosts, open ports and potential targets.

T1082System Information DiscoveryEvidence1

They appeal to attackers because they allow them to implement activity such as credential stealing, discovery, lateral movement and malware execution, and more, while blending in with harmless everyday IT activity.

Lateral Movement

3 techniques

T1021Remote ServicesEvidence2

They used the utility to open a new session to a domain controller with a domain admin password

T1021.001Remote Desktop ProtocolEvidence1

Test for the usage of RDP connecting to DC using dumped creds... ( mstsc /v: [IP_REDACTED] )

T1570Lateral Tool TransferEvidence1

Makop ransomware operators extensively use off-the-shelf open-source and freeware tools to conduct lateral movement and system discovery.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

the intruders started using PowerShell web requests to pull down files: first, a copy of a command-line version of the WinRAR utility, and then a pair of RAR archives on the compromised server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

fieldeffect blogNews

Aug 5, 2025

Update: Akira ransomware group targets SonicWall VPN appliances

Legitimate port scanning utility used for discovery (enumerating reachable services/ports) during the intrusion lifecycle.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Advanced Port Scanner