Impacket — Malware Profile
Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.
MITRE ATT&CK techniques (11)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1040 Network Sniffing
- T1047 Windows Management Instrumentation
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1558.003 Kerberoasting
- T1558.005 Ccache Files
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
IntelFusions coverage
- Akira Ransomware Targets Cisco VPNs Without MFA: Sophos Documents Over a Dozen Incidents 2026-02-16
- APT41 Expands into Africa: Kaspersky Uncovers Wicked Panda's Sophisticated Campaign Against Government IT Services 2026-02-16
- Stately Taurus (Mustang Panda) Conducts Two-Year Southeast Asian Government Espionage Operation: Three-DLL ToneShell Variant, ShadowPad, and Continuous File Exfiltration via Dropbox 2026-02-16
- Access broker exploits Citrix bug to plant DragonForce ransomware 2026-07-10
- Hacked Korean websites pushed spy backdoors and Gunra ransomware 2026-07-30
- Spies hit Central Asian ministries with backdoors built per victim 2026-07-30
- FBI and CISA warn of Gunra ransomware hitting hospitals 2026-08-10
- Exploited bugs up 34% as attackers beat the patch cycle 2026-09-03
- Spies and ransomware crews root Cisco firewall servers 2026-09-09
- NightEagle spies pivot from Asia to Russian networks 2026-09-16
- Ransomware crew appears to be writing its wipers with AI 2026-09-17
- INC ransomware now threatens victims with a press release 2026-09-22
- One ransomware affiliate, four brands, the same toolkit 2026-09-25
- China-linked hackers hide backdoor inside trusted apps 2026-09-28
Attributed threat actors
- Volt Typhoon
- APT41
- Andariel machine-inferred link
- MedusaLocker machine-inferred link
- BianLian machine-inferred link
- Medusa Ransomware machine-inferred link
- Chaos machine-inferred link
- Hive machine-inferred link
- Dragonfly
- APT10
- HAFNIUM
- Storm-1811
- Sandworm Team
- Mustang Panda
- FIN8
- FIN13
- Storm-0501
- Lotus Blossom
- APT29
- Cinnamon Tempest
- Ember Bear
- Velvet Ant
- APT35
- APT27