RustScan
RustScan is a publicly available modern port-scanning tool used to identify reachable network services, including SSH endpoints and open ports on targeted systems. In the provided reporting, it is described as a primitive subnet/network scanner or public tool used during post-compromise reconnaissance and lateral movement preparation rather than as bespoke malware. CERT-UA reported attackers it tracks as UAC-0247 used RustScan for network scanning inside compromised Ukrainian environments, including local self-government bodies and municipal healthcare institutions, alongside tools such as LIGOLO-NG and CHISEL. Separate reporting on the Linux intrusion chain ShadowHS states operators used RustScan to identify reachable SSH endpoints before downloading the tool spirit to brute-force SSH logins using default credentials. Additional ATT&CK-mapped reporting on Scattered Spider notes use of RustScan during activity cluster C0027 to scan for open ports on targeted VMware ESXi appliances. The content does not provide standalone RustScan-specific IOCs beyond noting that related reporting included SHA-256 hashes for RustScan binaries in the ShadowHS case.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Зокрема, виявлено як примітивні сканери підмереж, так і публічно доступний інструментарій, наприклад RUSTSCAN.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniques
Reconnaissance
Resource Development
1 technique
Resource Development
Execution
1 technique
Execution
Discovery
3 techniques
Discovery
while also conducting reconnaissance and lateral movement within networks. They employ subnet scanners and tools like RUSTSCAN
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Publicly available network scanner used for subnet reconnaissance during post-compromise activity.
Open-source port scanner used by the framework for discovery of SSH endpoints to support lateral movement.
Network port-scanning tool used for discovery of open services (e.g., scanning ESXi appliances).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.