Netscan.exe, Mimikatz, Angry IP Scanner, and RMM Tool Abuse

Key Takeaways

• Three select incidents. This post covers three of the 70 incidents Blackpoint’s SOC handled between May 29 and June 5, 2024: netscan.exe and FileZilla (Financials), Mimikatz (Consumer Non-Cyclicals), and Angry IP Scanner with AnyDesk (Energy).
• Common tools, many ransomware groups. Blackpoint’s Adversary Pursuit Group (APG) has tracked at least 17 ransomware operations using netscan.exe, six using FileZilla, 18 using AnyDesk, and 19 using Mimikatz.
• Detection and containment. Antivirus and/or EDR was present in two of the three environments. In every incident, Blackpoint’s MDR+R technology alerted, and the SOC isolated the affected devices.
• The outlook. The APG predicts these tools will likely keep being abused over the next 12 months, and that Mimikatz use is very likely to continue.
• Common defenses. Recurring mitigations include heuristics-based monitoring and better visibility, along with application control, least privilege, MFA, and network hardening.

Week in Review: 70 Incidents Involving Netscan.exe, Mimikatz, Angry IP Scanner, & RMM Tools

Between May 29-31 and June 01-05, 2024, Blackpoint’s Active Security Operations Center (SOC) responded to 70 incidents:

• 19 on-premises MDR incidents
• 51 Cloud Response for Microsoft 365 incidents
• No Cloud Response for Google Workspace incidents

These incidents included confirmed or likely threat actor use of:

• Netscan.exe, FileZilla, and RMM tools for discovery, exfiltration, and lateral movement
• Mimikatz for credential access
• Angry IP Scanner and AnyDesk for reconnaissance, persistence, and discovery

Below, we walk through three of these incidents. For each one, we explain why it matters to partners today, even if you haven’t been attacked yet, and how to reduce your risk with your current tech stack and Blackpoint Cyber.

Netscan.exe, FileZilla, & RMM Tool Abuse Incident with Financials Partner on 2024-05-29

Topline Takeaways: Netscan.exe Incident

• Industry target: Financials
• Attacker information: netscan, FileZilla, and the LabTech RMM tool
• Antivirus (AV) and/or EDR present? Yes
• Threat assessment: The APG predicts it is likely that threat actors will keep using netscan for discovery to exploit other Financials organizations over the next 12 months.
• Recommended mitigations:
  • Heuristics-based activity monitoring and remediation
  • Application allowlisting and blocklisting
  • Least-privilege access controls
  • Regularly audit both environment and endpoints

Netscan.exe Incident Timeline: May 29 to June 1, 2024

Wednesday (2024-05-29)

• Blackpoint’s MDR+R technology alerted to a Financials user account, $useraccount1, downloading and running netscan on a machine at an unusual time.
• The user then started to mount admin shares on a second machine.
• Another user account conducted remote execution on the first affected machine and added a user account to the domain.
• The Active SOC isolated the affected machine to prevent further malicious activity and contacted the Financials partner.

Friday (2024-05-31)

• MDR+R alerted to another Financials user account downloading and running netscan on a machine, then beginning to mount shares.
• The Active SOC isolated the affected machine and alerted the Financials partner.

Saturday (2024-06-01)

• MDR+R alerted to another user account downloading and running netscan on the partner’s device. The user then began to mount shares on multiple machines.
• The same user downloaded netscan and FileZilla on the affected machine.
• MDR+R then alerted to the user account installing FileZilla on another end client host machine.
• The Active SOC isolated the affected devices to prevent further malicious activity and contacted the partner.

What the SOC’s Threat Hunt Found

The Active SOC team ran a threat hunt on the environment. Analysts:

• Found FTP and FileZilla connections. Seven different devices were calling out to two public IPs. One IP was known malicious and traced back to Russia. The other traced back to the United States.
• Traced initial access. A user authenticated from one of those IP addresses to an end client host 31 minutes before the first netscan activity. Then:
  • 13 minutes after authenticating, the user account pinged “temp.sh,” used nslookup.exe to find the domain controller, and pinged the IP address traced to Russia.
  • Netscan activity started, and the user account mounted 216 shares through the IP address range.
• Found the LabTech RMM tool. The remote monitoring and management (RMM) tool LabTech was installed on an affected host machine. It was running ps1 scripts that queried users across the network, specifically looking for domain users.

What Is Netscan.exe?

Netscan.exe is a configurable network scanner for IPv4 and IPv6. It can ping computers, scan ports, discover shared folders, and retrieve information about network devices through WMI, SNMP, HTTP, SSH, and PowerShell (1).

Blackpoint’s APG has tracked at least 17 ransomware operations that use netscan.exe during reported incidents to identify targets within a compromised network.

What Is FileZilla, & How Is It Abused?

FileZilla is a cross-platform FTP, FTPS, and SFTP client (2). Blackpoint’s APG has tracked at least six ransomware groups that have used FileZilla to exfiltrate sensitive information from victims’ environments.

How Do Attackers Abuse RMM Tools?

RMM tools are used to manage a computer or network from a remote location (3). They help admins and IT companies work more efficiently by allowing monitoring, software installation, and management of network activity. LabTech RMM, now ConnectWise Automate, lets users automate IT services and deliver proactive IT service.

RMM tools are useful, but they also carry a lot of risk. Because they are built deeply into environments, they are an attractive target for threat actors (4). See Blackpoint’s Vulnerable RMM Tools and Vulnerable Industries: Why Vigilance is Key for more on this risk.

Threat actors abuse RMM tools to:

• Blend in with legitimate traffic
• Bypass detection, because the tools use legitimate certificates and processes
• Use a fully working tool without spending time and resources to build their own

APG Threat Analysis: Netscan.exe, FileZilla, and RMM Tool Abuse for 2024

The APG predicts that threat actors will likely keep abusing legitimate software and services for discovery, exfiltration, and lateral movement over the next 12 months. This is based on attacks Blackpoint has observed and on external incident reports that include RMM tool use.

• Black Basta and netscan.exe. In May 2024, the U.S. CISA released a #StopRansomware report on the Black Basta operation. It described the group’s use of netscan.exe in the discovery phase of an attack (5). Black Basta has been seen using the tool to scan networks, likely to find other machines it can access and encrypt.
• Akira and FileZilla. In April 2024, the U.S. CISA released a #StopRansomware report on the Akira ransomware operation. It described the group’s use of FileZilla to exfiltrate data that can be used to extort victims in double extortion operations (6).
• RMM tools in intrusions. RMM tools are frequently abused in cyberattacks. ReliaQuest researchers reported that between 2022 and 2024, more than one third of the intrusions the company responded to involved RMM tools (7).

How to Mitigate Netscan.exe, FileZilla, and RMM Tool Abuse

Blackpoint’s APG recommends these actions to reduce the malicious use of legitimate tools:

• Monitor system activity with heuristics-based triggers and alerts. This can flag legitimate software that is installed or used at unusual times, or by users who wouldn’t normally install it.
• Use application controls. They help manage and control software installation, including file transfer and RMM software. Learn more about Blackpoint Managed Application Control.
• Apply least privilege. Regular user accounts can’t install certain tools or carry out certain activities.
• Regularly audit both environment and endpoints. Audits can help find rogue software that could be abused.

Return to Top

Mimikatz LSASS Dumping Incident with Consumer Non-Cyclicals Partner on 2024-06-03

Topline Takeaways: Mimikatz Incident

• Industry target: Consumer Non-Cyclicals
• Attacker information: Storm-0335, Mimikatz, and a malicious .exe file
• Antivirus (AV) and/or EDR present? Yes
• Threat assessment: The APG predicts it is very likely that threat actors will keep using Mimikatz to exploit other Consumer Non-Cyclicals organizations over the next 12 months.
• Recommended mitigations:
  • Multifactor authentication (MFA)
  • Improve endpoint, asset, and overall environment visibility
  • Heuristics-based activity monitoring and remediation
  • Password managers

Mimikatz Incident Timeline for 2024-06-03

• Detection: Blackpoint’s MDR+R alerted to Storm-0335, a ransomware-linked emerging threat group, on a Consumer Non-Cyclicals partner endpoint.
• Credential dumping: Shortly after the malicious file was detected, MDR+R alerted to potential Mimikatz LSASS dumping on a host machine.
• Containment: The Active SOC isolated all affected devices to prevent further malicious activity and contacted the partner with more information and remediation advice.

What Is Mimikatz?

Mimikatz is a tool that extracts sensitive information, such as passwords and credentials, from a system’s memory (8). It was developed in 2007 and is still effective at gathering credentials. Attackers can then use those credentials to move laterally, elevate privileges, and bypass detection.

Credential-Gathering Techniques Mimikatz Supports

Mimikatz can perform several credential-gathering techniques, including:

• Pass-the-hash attacks
• Pass-the-ticket attacks
• Pass-the-key attacks
• Kerberoasting
• Pass-the-cache attacks

Blackpoint’s APG has tracked at least 19 ransomware operations and 43 threat groups reported to use Mimikatz.

For another Mimikatz-related SOC incident review, see Mimikatz, LaZagne, CredentialsFileView, Raspberry Robin, and Scheduled Tasks Abuse.

APG Threat Analysis: Mimikatz for 2024

The APG predicts that threat actors will very likely keep using Mimikatz over the next 12 months. This is based on attacks Blackpoint has observed and on external reporting about Mimikatz in cyberattacks.

• Trigona (March 2023). Palo Alto Unit 42 researchers released a report on the Trigona ransomware operation that included Mimikatz use in a reported incident (9). Like many ransomware operations, the group used Mimikatz to gather and manipulate credentials. Those credentials can be used to move laterally and reach other parts of the network where data can be exfiltrated and encrypted.
• LockBit and Play (June 2024). Mandiant researchers reported that Mimikatz was used in numerous incidents to obtain valid credentials (10). They detailed its use by both LockBit and Play ransomware operations, which then used the credentials for lateral movement and privilege escalation.

How to Mitigate Mimikatz Credential Theft

Blackpoint’s APG recommends these actions to reduce Mimikatz abuse for credential access:

• Enable multi-factor authentication (MFA). It can help identify malicious or unusual logins and adds a step to secure user accounts.
• Improve endpoint, asset, and overall environment visibility. This can help identify unusual behavior related to credential dumping.
• Monitor system activity with heuristics-based triggers and alerts. This can help identify the malicious install, use, and presence of unapproved tools and activity on devices.
• Require secure password managers. Also disable plaintext password storage and local password caching, which makes passwords harder to access.

Return to Top

Angry IP Scanner & AnyDesk Abuse Incident with Energy Partner on 2024-06-04

Topline Takeaways: Angry IP Scanner and AnyDesk Incident

• Industry target: Energy
• Attacker information: Angry IP Scanner, AnyDesk, r.exe, and ipscan.exe
• Antivirus (AV) and/or EDR present? No
• Threat assessment: The APG predicts it is likely that threat actors will keep using Angry IP Scanner and AnyDesk to exploit other Energy organizations over the next 12 months.
• Recommended mitigations:
  • Improve endpoint, asset, and overall environment visibility
  • Dedicated software center
  • Zero trust network architecture
  • Block inbound and outbound connections on common ports

Angry IP Scanner & AnyDesk Incident Timeline for 2024-06-04

• Detection: Blackpoint’s MDR+R alerted to Angry IP Scanner on an Energy partner’s machine. It then alerted to a silent installation of AnyDesk on a second machine in a suspicious location.
• Containment and investigation: The Active SOC isolated the devices to prevent further malicious activity. It then investigated and identified a user account that created a domain admin user account. That discovery led to another device being isolated for potential compromise.
• Additional findings: The SOC also identified a brute force attack against multiple M365 accounts. One isolated device was exposed to the internet with multiple open ports. There was an even chance that the threat actor exploited any service exposed to the internet from the compromised device.
• Partner outreach: The Active SOC contacted the Energy partner with incident assistance and remediation advice.

What Is AnyDesk, & How Do Attackers Abuse It?

AnyDesk is an RMM tool used to remotely access and manage devices on a network. It is a legitimate tool that threat actors often exploit during cyberattacks. Blackpoint’s APG has tracked at least 18 ransomware operations that used AnyDesk in reported incidents.

Threat actors don’t only abuse software like AnyDesk. They also target the software itself. In January 2024, AnyDesk’s parent company was hit by a cyberattack, which shows why RMM tools are attractive to threat actors from two directions (11). See Blackpoint’s AnyDesk attack response analysis for more.

What Is Angry IP Scanner?

Angry IP Scanner is a network scanner that efficiently scans IP addresses and ports. It can also resolve hostnames, determine MAC addresses, and scan ports (12).

Is Angry IP Scanner Safe?

Angry IP Scanner is a legitimate network scanner. But threat actors have often been seen using legitimate network scanners like it to identify remote systems inside a compromised network.

In February 2024, the U.S. CISA released a #StopRansomware report on the Phobos ransomware operation. It described the group’s use of Angry IP Scanner during the reconnaissance phase of its attacks to search for vulnerable RDP ports (13).

APG Threat Analysis: Angry IP Scanner & AnyDesk for 2024

The APG predicts that threat actors will likely keep using Angry IP Scanner and abusing AnyDesk for reconnaissance, discovery, and persistence over the next 12 months. This is based on attacks Blackpoint has observed and on external reporting about the abuse of these two legitimate tools.

• Akira and AnyDesk. The U.S. CISA detailed Akira ransomware operators’ use of AnyDesk to set up command and control channels and to transfer files remotely. The group has also used it to gain remote access to victim systems (6).
• CISA RMM advisory (January 2023). The U.S. CISA warned that threat actors use legitimate RMM tools, including AnyDesk. It identified a campaign where phishing emails led victims to download legitimate software, which the actors then used in a refund scam to steal money from victims’ bank accounts (14).
• Iranian-linked groups (2020). The U.S. CISA reported that Iranian-linked threat groups used Angry IP Scanner to detect remote systems connected to compromised networks (15). Threat actors can then move laterally to those devices to collect sensitive information.
• Look-alike domains (Zscaler). Other legitimate tools like Angry IP Scanner can also be abused. Zscaler researchers reported a Google malvertising campaign that used look-alike domains and Google Ads to push them to the top of search results (16). The group registered 45 domains with sites impersonating legitimate software, including Angry IP Scanner.

This incident shows how threat actors abuse legitimate tools for reconnaissance and discovery, and as lures for initial access.

How to Mitigate Angry IP Scanner & AnyDesk Abuse

Blackpoint’s APG recommends these actions to reduce the malicious use of legitimate tools for persistence, discovery, and reconnaissance:

• Improve security visibility. Better visibility across networks, endpoints, and other managed assets helps detect suspicious installs and actions by threat groups using unauthorized but legitimate tools and software.
• Provide a dedicated software center. Employees can download approved software from a safe, monitored location. This also helps detect software, such as AnyDesk, that is installed from somewhere else.
• Operate with a zero-trust mentality. This assumes every request to every resource is malicious and relies on aggressive, continuous monitoring and management.
• Block inbound and outbound connections on common ports. This can help block illegitimate activity by threat actors.

Return to Top

See How Blackpoint Responds to Legitimate Tool Abuse

In each incident above, Blackpoint’s MDR+R technology alerted and the Active SOC isolated the affected devices to prevent further malicious activity. See how 24/7 managed detection and response helps MSPs catch abused tools across client environments.

Request a Demo →

References and Resources

A quick note on incident details:

As these analyses concern recent incidents in actively monitored environments, certain details may be occasionally omitted and/or obfuscated, to better secure our partners and protect any still-ongoing investigations.

However, we felt that these incidents were important enough to bring to the community’s attention as fast as possible, and so included them in this public writeup.

Please feel free to reach out to the APG directly if you have any questions about a specific incident!

Click for full reference list

1. SoftPerfect’s Blog: “SoftPerfect Network Scanner” by SoftPerfect on N/A
2. FileZilla’s Blog: “FileZilla Features” by FileZilla on N/A
3. Tarian’s Blog: “What is a RMM Software Tool?” by Tarian on 2024-02-15
4. Blackpoint Cyber’s Blog: “Vulnerable RMM Tools and Vulnerable Industries: Why Vigilance is Key” by Blackpoint Cyber on 2024-03-28
5. CISA’s “#StopRansomware: Black Basta”: Advisory by CISA on 2024-05-10
6. CISA’s Advisory: “#StopRansomware: Akira Ransomware” by CISA on 2024-04-18
7. ReliaQuest’s Blog: “RMM Tool Abuse” by ReliaQuest Threat Research Team on 2024-02-20
8. SentinelOne’s Blog: “What is Mimikatz?” by SentinelOne on 2024-04-03
9. Palo Alto’s Blog: “Bee-Ware of Trigona, An Emerging Ransomware Strain” by Frank Lee; Scott Roland on 2023-03-16
10. Mandiant’s Blog: “Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools” by Bavi Sadayappan; Zach Riddle; Jordan Nuce; et. al. on 2024-06-03
11. Blackpoint Cyber’s Blog: “AnyDesk Attack Response Stirs Threat Analyst Criticism and Doubts” by Blackpoint Cyber on 2024-02-07
12. Airbus’s Blog: “Uncovering Cyber Intruders: A Forensic Deep Dive into NetScan, Angry IP Scanner, and Advanced Port Scanner” by Julien Houry on 2024-03-14
13. CISA’s Advisory: “#StopRansomware: Phobos Ransomware” by CISA on 2024-02-29
14. CISA’s Advisory: “Protecting Against Malicious Use of Remote Monitoring and Management Software” by CISA on 2023-01-26
15. CISA’s Advisory: “Iran-Based Threat Actor Exploits VPN Vulnerabilities” by CISA on 2020-09-15
16. Zscaler’s Blog: “Malvertising campaign targeting IT teams with MadMxShell” by Roy Tay and Sudeep Singh on 2024-04-17