Fscan
FScan is an open-source network scanning utility written in Go and described in the reporting as an intranet/network scanner used to identify open ports across IP subnets and support internal reconnaissance. It has been observed post-compromise in multiple intrusion sets as a public tool rather than a bespoke malware family. Cisco Talos reported Chinese-speaking APT cluster UAT-7237 using FScan during intrusions targeting web infrastructure entities in Taiwan, including a compromised Taiwanese web hosting provider, to search for open ports, discover endpoints, and support lateral movement alongside SMB scanning and stolen credentials. Talos also reported UAT-9921 using Fscan from compromised hosts in support of internal and external scanning tied to the VoidLink framework. Palo Alto Networks Unit 42 observed CL-STA-0969, a nation-state-linked cluster overlapping with Liminal Panda, using FScan in 2024 operations against telecommunications providers in Southwest Asia. JPCERT/CC reported attackers exploiting Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 deploying Fscan via DLL side-loading/FilelessRemotePE-based loaders during post-exploitation to scan internal systems; the same reporting notes Fscan has been adopted by various Chinese hacking groups. Additional reporting on attacks against South Korean web servers also describes use of Fscan for system and network discovery. High-confidence behavior directly mentioned in the content is limited to network/intranet scanning for open ports and endpoint discovery; no unique persistence or payload-delivery capability is attributed to FScan itself in the provided material.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...using a mix of custom and public tools such as Microsocks, FRP, FScan, and Responder...
"For its network-scanning activities, UAT-7237 uses FScan to search for open ports..."
The threat actor has also been observed deploying a SOCKS proxy on compromised servers to launch scans for internal reconnaissance and lateral movement using open-source tools like Fscan.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueDue to mistakes on the attacker’s side, we managed to retrieve multiple files from Earth Krahang’s servers, including samples, configuration files, and log files from its attack tools.
Initial Access
1 techniquePersistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueDiscovery
1 techniqueUAT-7237 exploits unpatched servers for initial access, then performs rapid reconnaissance using commands like nslookup, systeminfo, and ping before establishing persistence via SoftEther VPN and RDP rather than web shells.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An open-source network scanning/reconnaissance tool used by the operators for internal reconnaissance and to support lateral movement activities after compromise.
Network scanning tool used to identify open ports/services and support lateral movement discovery.
Network scanning utility used to identify reachable hosts and open ports for follow-on lateral movement.
FScan is a network scanning tool used to identify open ports and services on IP subnets, aiding in lateral movement and reconnaissance.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.