Loading malware…
PingCastle is a legitimate Active Directory security assessment and reconnaissance utility. In the provided reporting, it is described as being used for Active Directory reconnaissance, including by the financially motivated threat actor Octo Tempest alongside ADRecon, and it is also listed by Kaspersky as a utility shared across ransomware-linked groups including Crypt Ghouls, MorLock, BlackJack, and Twelve. The cited use cases are focused on post-compromise enumeration of Active Directory environments. No specific infection vector, persistence mechanism, or indicators of compromise for PingCastle itself are provided in the content.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...utilities, including SoftPerfect Network Scanner, PingCastle..."
"...utilities, including SoftPerfect Network Scanner, PingCastle..."
"...utilities, including SoftPerfect Network Scanner, PingCastle..."
"...utilities, including SoftPerfect Network Scanner, PingCastle..."
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Tools Used ... Discovery ... PingCastle
«Запрос всех компьютеров домена через Get-ADComputer -Filter * возвращает полный список хостов с IP-адресами».
Initial bulk-export of users, groups, and device information is closely followed by enumerating data and resources readily available to the user’s profile... AAD bulk downloads of user, groups, and devices.
«Network Service Discovery (T1046, Discovery) внутри сети»; «один source IP → N уникальных destination ports за T секунд».
AD enumeration tools that can be used to find weaknesses in Active Directory were also seen in the form of Pingcastle and Sharphound
«Get-ADUser -Filter {ServicePrincipalName -ne "$null"} выдаёт сервисные аккаунты».
BianLian group actors used PingCastle to enumerate the AD and map trust relationships.
The threat actor moved cab files to the remote hosts using SMB and then expanded and ran them using wmiexec.py commands.
The malware will communicate with its command and control (C2) server, downloading additional modules and tools.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.