Loading malware…
Impacket is a widely used open-source Python toolkit for working with Windows network protocols that is frequently abused in intrusions for post-exploitation operations. Although originally developed for legitimate protocol interaction, testing, and administration, it is commonly used by threat actors and ransomware affiliates to perform remote command execution, credential dumping, reconnaissance, and lateral movement in Windows and Active Directory environments.
Operationally, Impacket is associated with tooling that abuses SMB, WMI, RPC, and related administrative mechanisms to execute commands on remote systems, interact with administrative shares, create services, and obtain semi-interactive shells. It is also used for credential access, including remote extraction of secrets from domain controllers and other Windows hosts, and has been observed in activity involving NTLM relay and DCSync-style replication abuse. Multiple intrusion reports tie Impacket to hands-on-keyboard operations following initial compromise, including movement to domain controllers, harvesting of Active Directory credential material, and support for ransomware deployment.
Impacket has been observed across a broad range of threat activity, including financially motivated ransomware intrusions, initial access broker operations, and state-linked or espionage-oriented campaigns. It has been associated with actors and clusters including Qilin-linked intrusions, Warlock-related activity, Storm-2603, menuPass, UAT-8837, Elephant Beetle, and HomeLand Justice operations. In many cases it appears alongside other dual-use or offensive tools such as Mimikatz, PsExec, BloodHound, Cobalt Strike, and remote administration utilities.
The toolkit primarily targets Windows enterprise environments, especially domain-joined systems and domain controllers, where its protocol-level access enables stealthy remote operations without requiring malware deployment on every target. Its prevalence in real-world incidents and red-team activity has made it one of the most recognizable post-exploitation toolsets in modern Windows intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Post-exploitation : Impacket , attaques NTLM relay, mouvement latéral
A working proof-of-concept (PoC) exploit has been released for a new NTLM reflection bypass flaw that enables SYSTEM-level access on Windows Server 2025. The vulnerability, tracked as CVE-2026-24294, abuses a feature introduced in Windows 11 24H2 and Windows Server 2025 that allows SMB connections over arbitrary TCP ports.
Impacket is a versatile, dual-use tool that uses Python-based scripts to exploit legitimate Windows services and protocols... threat actors frequently use psexec.py, smbexec.py, and wmiexec.py scripts within Impacket to execute code remotely on Windows systems without additional payloads or tools.
50 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For Managed Services, menuPass used a suite of malware including Sigloader, P8RAT, FYAnti, Impacket, and QuasarRat.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Impacket activity was detected in the organization’s network, indicating its use of Windows network protocol interactions. The observed command lines align with Impacket's smbexec script, enabling a semi-interactive shell via SMB.
When compromising Windows Domain Controllers servers, the group harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised DC to locally decrypt it.
During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Suppose that we have a TGT for the machine account min-frperso-01$.minus.sub.frperso.local... we can obtain administrative access to its network share.
Suppose that we have a TGT for the machine account min-frperso-01$.minus.sub.frperso.local... we can obtain administrative access to its network share.
Step 2: Configure RBCD on target Computer Account ... Set-DomainObject -Set @{ 'msds-allowedtoactonbehalfofotheridentity' = $SDBytes }
The selection of the Default Domain Policy ({31B2F340–016D-11D2–945F-00C04FB984F9}) is deliberate. This is the default Group Policy Object (GPO) applied to all objects within the domain, ensuring that the payload is executed on every system joined to the victim’s pokka.local domain.
The selection of the Default Domain Policy ({31B2F340–016D-11D2–945F-00C04FB984F9}) is deliberate. This is the default Group Policy Object (GPO) applied to all objects within the domain, ensuring that the payload is executed on every system joined to the victim’s pokka.local domain.
Этап 4 - DCSync (T1003.006, Credential Access). С привилегиями SYSTEM на DC выполняем DCSync через secretsdump.py (Impacket) или mimikatz lsadump::dcsync /all - получаем NTLM-хеши всех учётных записей домена, включая krbtgt.
Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target.
Без подписи атакующий перехватывает запрос аутентификации одного хоста и перенаправляет на другой (SMB relay).
Post-exploitation activity has included rapid configuration retrieval, IPsec tunnel establishment, and lateral movement using tools such as Impacket and NTLM relay attacks.
They request a Kerberos Ticket (TGT) for the dMSA... Because the state is “Completed,” the KDC follows a new rule built into Windows Server 2025: “If a migration is complete, the successor (dMSA) should act as the predecessor (Admin).”
Golden Ticket Attacks : If an attacker obtains the KRBTGT account's password hash, they can forge TGS for any user in the domain, including Domain Admins, providing complete and persistent domain control.
Сюда же примыкают Kerberoasting (T1558.003, Credential Access) ... обе техники начинаются с LDAP-запроса для поиска целевых учёток. | Impacket GetUserSPNs.py отправляет фильтр для поиска Kerberoastable-аккаунтов: (&(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(servicePrincipalName=*))
If you want to probe RPC remotely, the data set we can get is dramatically reduced. There are literally two options: query the Endpoint Mapper service or brute force UUIDs of known interfaces and then their methods by OpNum. | We can query the EpMapper service and find out the endpoints on which specific RPC interfaces are running... RpcMgmtEpEltInqBegin() to begin examining the list of endpoints from EpMapper and RpcMgmtEpEltInqNext() to get the next element of the list.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
89 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Offensive post-exploitation toolkit used after VPN compromise for lateral movement, protocol abuse, configuration retrieval, and tunnel establishment.
Framework used post-compromise for lateral movement and NTLM relay abuse.
Offensive tooling used against domain controllers for remote execution and follow-on activity during the intrusion.
Набор постэксплуатационных инструментов; в тексте упомянут модуль smbexec для подключения к ADMIN$ по SMB, копирования бинаря и его запуска на удалённой системе.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.