Netscan.exe, Mimikatz, Angry IP Scanner, and RMM Tool Abuse

Netscan.exe

Netscan.exe is a configurable IPv4/IPv6 scanner that can pin computers, scan ports, discover shared folders, and retrieve any information about network devices via WMI, SNMP, HTTP, SSH and PowerShell (1). Blackpoint’s APG has tracked at least 17 ransomware operations that use the netscan.exe tool during reported incidents to identify targets within a compromised network.

FileZilla

FileZilla is a cross-platform FTP, FTPS, and SFTP client (2). Blackpoint’s APG has tracked at least six ransomware groups that have used the FileZilla tool to exfiltrate sensitive information from victims’ environment.

RMM Tool Abuse

RMM tools are tools used for managing a computer or a network from a remote location (3). The tool offers admins and IT companies a way to work more efficiently, allowing monitoring, installing software, and managing activities on the network. LabTech RMM (currently ConnectWise Automate) is a RMM that allows users to automate IT services, and provide proactive IT service delivery.

RMM tools are useful for organizations but also present a tremendous amount of risk to organizations as their inherent integration into environments also presents an attract target for threat actors (4), due to threat actor’s ability to abuse RMM tools to:

• Blend in with legitimate traffic,
• Bypass detection, as the tools use legitimate certificates and processes; and
• Use a fully functional tool without having to spend the time and resources to develop the tool themselves.

The APG predicts that threat actors will likely continue to abuse legitimate software and services for discovery, exfiltration, and lateral movement over the next 12 months.

This assessment is based on internal Blackpoint observed attacks and external incident reports that include the use of RMM tools.

• In March 2024, the U.S. CISA released a #StopRansomware report detailing the Black Basta operation. The report included details of the operations’ use of netscan.exe for the discovery phase of an attack (5). Black Basta has been observed using the tool to conduct network scanning, likely in an attempt to identify other machines that can be accessed and encrypted.
• In April 2024, the U.S. CISA released a #StopRansomware report detailing the Akira ransomware operation. The report included details of the operations’ use of FileZilla to exfiltrate data that can be used to extort victims in their double extortion operations (6).

RMM tools specifically are frequently abused during cyberattacks. Security researchers with ReliaQuest reported that between 2022 and 2024, more than one third of the intrusions the company responded to involved RMM tools (7).

Blackpoint’s APG recommends the following actions to help mitigate the malicious use of legitimate tools.

• Monitor system activity through heuristics-based triggers and alerts, which can help identify legitimate software being installed or used at unusual times and by users that would not install these tools as part of their normal operations.
• Implement application controls to help manage and control the installation of software, including file transfer and RMM software.
• Implement the practice of least privilege, which will help ensure regular user accounts are unable to install certain tools and conducting certain activities.
• Regularly audit and both environment and endpoints that can aid in identifying rogue software installed that can be abused for malicious actions.

Mimikatz is a tool that is used to extract sensitive information, such as passwords and credentials, from a system’s memory (8). The tool was developed in 2007 and is still an effective tool for gathering credentials, which can then be used to move laterally, elevate privileges, and bypass detection methods.

The tool is capable of performing multiple credential gathering techniques, including pass-the-hash attacks, pass-the-ticket attacks, pass-the-key attacks, kerberoasting, and pass-the-cache attacks. Blackpoint’s APG has tracked at least 19 ransomware operations and 43 threat groups that have been reported using Mimikatz.

The APG predicts that threat actors will very likely continue to use Mimikatz over the next 12 months.

This assessment is based on internal Blackpoint observed attacks and external reporting related to the use of Mimikatz during a cyberattack.

• In March 2023, security researchers with Palo Alto Unit 42 released a report detailing the Trigona ransomware operation, which included the use of Mimikatz during a reported incident (9). The group, similar to many other ransomware operations, used Mimikatz to gather credentials and manipulate the credentials that can be used to move laterally and access other areas of the compromised network where data can be exfiltrated and encrypted.
• In June 2024, security researchers with Mandiant reported that Mimikatz was used in numerous incidents to obtain valid credentials (10). The researchers detailed the use of Mimikatz by both LockBit and Play ransomware operations that were then used for lateral movement and privilege escalation.

Blackpoint’s APG recommends the following actions to help mitigate the abuse Mimikatz for credential access.

• Enable multi-factor authentication (MFA), which can help identify malicious or anomalous logins and require an additional step for securing user accounts.
• Improve endpoint, assets, and overall environment, which can aid in identifying anomalous behavior related to credential dumping.
• Monitor system activity through heuristics-based triggers and alerts, which can aid in identifying the malicious install, use, and presence of unapproved tools and malicious activities on devices.
• Require the use of secure password managers and disable the storage of plaintext passwords and local password caching to make accessing passwords more difficult.

AnyDesk

AnyDesk is a RMM tool that is used to remotely access and manage devices within a network; it is a legitimate tool that is often exploited by threat actors during cyberattacks. Blackpoint’s APG has tracked at least 18 ransomware operations that have used AnyDesk during reported incidents. Not only do threat actors abuse software, like AnyDesk, to conduct malicious activities but also target the software in cyberattacks as well.

In January 2024, AnyDesk’s parent company was targeted in a cyberattack, which highlights the dual-sided attractiveness of RMM tools by threat actors (11).

Angry IP Scanner

Angry IP Scanner is a network scanner that efficiently scans IP addresses and ports, with the ability to resolve hostnames, determine MAC addresses, and scan ports (12). Threat actors have often been observed using legitimate network scanners, like Angry IP Scanner, to identify remote systems within a compromised network.

In February 2024, the U.S. CISA released a #StopRansomware report detailing the Phobos ransomware operation, which included information about the group’s use of Angry IP Scanner (13). The group had been observed using the tool during the reconnaissance phase of their attacks to search for vulnerable RDP ports.

The APG predicts that threat actors will likely continue to use Angry IP Scanner and abuse AnyDesk for reconnaissance, discovery, and persistence over the next 12 months.

We base this assessment on internal Blackpoint observed attacks, as well as external reporting related to the use of the abuse of two legitimate tools.

The U.S. CISA detailed Akira ransomware operators’ use of AnyDesk to establish command and control channels and use of the tool for remote file transfer. The group has also been observed using the tool to obtain remote access to victim systems (5).

Additionally, in January 2023, the U.S. CISA released an advisory warning of threat actors’ use of legitimate RMM tools, including AnyDesk. This included the identification of a malicious campaign involving the use of legitimate RMM software; specifically sending phishing emails that led to the download of the legitimate software, which the actors used in a refund scam to steal money from victims’ bank accounts (14).

In 2020, the U.S. CISA reported that Iranian-linked threat groups had been observed using the Angry IP Scanner to detect remote system connected to compromised networks (15). Threat actors can then move laterally to the discovered remote devices to collect sensitive information.

Similar to RMM software abuse, other legitimate tools like Angry IP Scanner can be abuse for malicious purposes. Security researchers with Zscaler reported a Google malvertising campaign that used multiple look-alike domains and leveraged Google Ads to push the domains to the top of the search engine results (16). The group registered 45 domains with sites impersonating legitimate software, including Angry IP Scanner.

This incident highlights the way threat actors abuse legitimate tools for conducting reconnaissance and discovery techniques, as well as lures for initial access.

Blackpoint’s APG recommends the following actions to help mitigate the malicious use of legitimate tools for persistence, discovery, and reconnaissance.

• Improve security visibility of networks, endpoints, and other managed assets to aid in detecting and alerting to suspicious installs and actions conducted by threat groups using unauthorized but legitimate tools and software.
• Provide a dedicated software center, which allows employees to download approved software from a safe and monitored location. Dedicated and approved software can aid in detecting software, such as AnyDesk, that is installed from a third-party location outside of a dedicated center.
• Operate from a zero-trust mentality, which assumes that all requests to each resource is malicious and embodies aggressive and continuous monitoring and management.
• Block inbound and outbound connections on common ports, which can aid in blocking illegitimate activities conducted by threat actors.

1. 
   SoftPerfect’s Blog: “SoftPerfect Network Scanner” by SoftPerfect on N/A
2. 
   FileZilla’s Blog: “FileZilla Features” by FileZilla on N/A
3. 
   Tarian’s Blog: “What is a RMM Software Tool?” by Tarian on 2024-02-15
4. 
   Blackpoint Cyber’s Blog: “Vulnerable RMM Tools and Vulnerable Industries: Why Vigilance is Key” by Blackpoint Cyber on 2024-03-28
5. 
   CISA’s “#StopRansomware: Black Basta”: Advisory by CISA on 2024-05-10
6. 
   CISA’s Advisory: “#StopRansomware: Akira Ransomware” by CISA on 2024-04-18
7. 
   ReliaQuest’s Blog: “RMM Tool Abuse” by ReliaQuest Threat Research Team on 2024-02-20
8. 
   SentinelOne’s Blog: “What is Mimikatz?” by SentinelOne on 2024-04-03
9. 
   Palo Alto’s Blog: “Bee-Ware of Trigona, An Emerging Ransomware Strain’ by Frank Lee; Scott Roland on 2023-03-16
10. 
    Mandiant’s Blog: “Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools” by Bavi Sadayappan; Zach Riddle; Jordan Nuce; et. al. on 2024-06-03
11. 
    Blackpoint Cyber’s Blog: “AnyDesk Attack Response Stirs Threat Analyst Criticism and Doubts” by Blackpoint Cyber on 2024-02-07
12. 
    Airbus’s Blog: “Uncovering Cyber Intruders: A Forensic Deep Dive into NetScan, Angry IP Scanner, and Advanced Port Scanner” by Julien Houry on 2024-03-14
13. 
    CISA’s Advisory: “#StopRansomware: Phobos Ransomware” by CISA on 2024-02-29
14. 
    CISA’s Advisory: “Protecting Against Malicious Use of Remote Monitoring and Management Software” by CISA on 2023-01-26
15. CISA’s Advisory: “Iran-Based Threat Actor Exploits VPN Vulnerabilities” by CISA on 2020-09-15
16. Zscaler’s Blog: “Malvertising campaign targeting IT teams with MadMxShell” by Roy Tay and Sudeep Singh on 2024-04-17