{
  "family": "nettool",
  "sample_count": 23,
  "category": "ransomware",
  "description": "HackTool:Win32/Nettool is a broad classification for dual-use network diagnostic utilities (like port scanners, packet sniffers, or netcat variants) that, while legitimately used by system administrators, are frequently weaponized by attackers to map internal networks and facilitate lateral movement.<br><br><b>Understanding Nettool</b><br>To an end-user, Nettool binaries are command-line utilities that do nothing visible unless explicitly run. For an incident responder, a Nettool detection on an endpoint (especially a non-IT workstation) is a massive red flag. Attackers who have gained initial access via a Trojan (like Emotet or Trickbot) will often drop Nettool binaries (such as Nmap, Advanced IP Scanner, or Angry IP Scanner) to map the internal corporate network, locate Domain Controllers, and identify open SMB or RDP ports on adjacent machines.<br><br><b>Execution and Network Reconnaissance</b><br>Nettool binaries are typically downloaded post-compromise by a C2 framework (like Cobalt Strike) (`T1105`). The attacker executes them via the command line or PowerShell (`T1059.003`), providing specific subnets to scan. The tools aggressively probe the local network (`T1046`), sending thousands of SYN packets or ICMP echo requests to identify active hosts and open ports. Advanced variants (like modified netcat) may be used to establish reverse shells or bind shells to allow the attacker interactive access without relying on the initial malware's C2 channel.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the facilitation of lateral movement, often leading to enterprise-wide ransomware deployment. EDR platforms should alert on the execution of known hacking tools from unusual directories (e.g., `%Temp%` or `C:\\PerfLogs`). Network Intrusion Detection Systems (NIDS) will flag the massive volume of horizontal port scanning originating from a single internal endpoint, which is highly anomalous behavior for a standard user workstation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1046",
    "T1018",
    "T1059.003",
    "T1090"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint where the Nettool was detected; the attacker is actively performing reconnaissance and preparing to move laterally.",
    "Review firewall and NIDS logs to determine the scope of the attacker's scan. Identify which internal IP addresses the Nettool probed successfully.",
    "Perform a forensic investigation on the isolated machine to determine *how* the Nettool was dropped (e.g., identifying the initial Trojan or compromised RDP session).",
    "Hunt across the enterprise for the specific Nettool hash to ensure the attacker has not already copied it to other internal servers."
  ],
  "what_to_avoid": [
    "Do not assume the Nettool alert is a false positive generated by IT staff without verifying the source and timing of the execution.",
    "Avoid simply deleting the tool; the presence of a HackTool means a human attacker is likely actively operating within the network."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}