NetScan

NetScan is a well-known dual-use network reconnaissance and scanning tool used by threat actors during post-compromise discovery. In the provided reporting, attackers used NetScan to scan internal networks and support lateral movement and broader infrastructure compromise. One intrusion report specifically observed execution of netscan.exe from C:\ProgramData\VMware\lib2lib\netscan.exe during a ransomware attack that began with compromised SSL-VPN access, followed by credential theft, suspected DCSync activity, Microsoft 365 token abuse, cloud data exfiltration with rclone, and ransomware deployment. NetScan is also repeatedly cited as part of living-off-the-land or dual-use tooling sets alongside Netexec, MeshAgent, and modified Rustdesk in ransomware operations.

The content associates NetScan with multiple ransomware-related intrusions and operators. It was used in activity involving an anonymized ransomware intrusion investigated by Yarix, in campaigns involving the newly observed Osiris ransomware family targeting a major food service franchisee operator in Southeast Asia in November 2025, and in Storm-1175 activity linked by Microsoft to Medusa ransomware exploitation of Fortra GoAnywhere MFT CVE-2025-10035. In the Storm-1175 case, Microsoft explicitly described NetScan as being used for network reconnaissance after initial access. In the Osiris reporting, defenders were advised to monitor for NetScan as one of the tools used in the campaign.

High-confidence indicators directly mentioned in the content are limited. The content references a SHA256 entry for a NetScan sample but does not provide the full hash value in the supplied text. A concrete file path observed in one incident is C:\ProgramData\VMware\lib2lib\netscan.exe. Overall, NetScan should be understood here as a legitimate or dual-use reconnaissance utility frequently abused by ransomware operators and affiliates for internal network enumeration rather than as a bespoke malware family.