Loading malware…
SharpShares is a dual-use network-share enumeration tool used to discover accessible shared resources in Windows domain environments. It supports automated reconnaissance of enterprise storage, helping operators identify network shares for subsequent investigation and data collection. Its functionality aligns with the MITRE ATT&CK Network Share Discovery technique (T1135).
SharpShares has been used during intrusions associated with GOLD OGRE and Aur0ra ransomware, SafePay ransomware, and BianLian data-extortion operations. In these operations, it serves as a discovery utility within broader post-compromise toolkits. Its use does not by itself establish malicious activity, and the credential theft, privilege escalation, exfiltration, and encryption performed during those intrusions are not established capabilities of SharpShares itself.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
This was their opening move, to map the Active Directory environment.
« Énumération des partages réseau via SharpShares »
Further after receiving access, the threat actor would install other tools such as Rclone, SharpShares and SoftPerfect network Scanner to steal user data.
The malware will communicate with its command and control (C2) server, downloading additional modules and tools.
Legitimate cloud tools, such as s5cmd and the utility SharpShares, then handled data exfiltration.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.