ADRecon — Malware Profile

Active Directory reconnaissance and reporting tool abused for domain mapping.

IntelFusions coverage

• Scattered Spider Q2 2025: vCenter Unmanaged VM ntds.dit Dumping, Chisel/Teleport/Pinggy Tunneling, S3 Browser Exfiltration, and Email Transport Rule Hijacking 2026-02-16

Attributed threat actors

• DarkSide machine-inferred link
• PYSA machine-inferred link
• Head Mare machine-inferred link

Read the full analysis on IntelFusions