Loading malware…
Impacket is a widely used open-source Python toolkit for working with Windows network protocols and remote administration mechanisms. Although it is a legitimate offensive security and protocol implementation framework rather than a malware family in the traditional sense, it is frequently abused by intrusion operators for post-compromise activity in enterprise Windows environments. Commonly observed uses include remote command execution over SMB and WMI, credential dumping through SecretsDump, NTLM relay operations, reconnaissance, internal network scanning, lateral movement, and interaction with domain controllers and other high-value systems.
The toolkit has been used across a broad range of intrusions involving state-linked espionage actors, ransomware affiliates, and financially motivated operators. Reported users include groups such as APT10, Storm-0501, Black Basta operators, and actors associated with Warlock intrusions, among others. In these operations, Impacket commonly appears after initial access has already been established through methods such as exploitation of public-facing applications, compromised remote access infrastructure, or social engineering-assisted remote access. Operators then use its modules to enumerate hosts, dump credentials and password material, move laterally, and execute commands remotely with comparatively low friction using native Windows protocols.
Frequently abused components include SecretsDump for extracting account secrets and hashes, smbexec for semi-interactive command execution via SMB, and wmiexec for remote execution through Windows Management Instrumentation. Impacket is also associated with deployment workflows involving remote service creation, SMB admin shares, and operations against Active Directory infrastructure. Its prevalence in hands-on-keyboard intrusions has made it a common detection target in endpoint and network monitoring products.
Impacket primarily operates in Windows-centric enterprise networks, especially Active Directory environments, though the toolkit itself is executed from Python-capable operator systems. Its role is best characterized as a post-exploitation framework and lateral movement toolkit rather than standalone malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Post-exploitation : Impacket , attaques NTLM relay, mouvement latéral
A working proof-of-concept (PoC) exploit has been released for a new NTLM reflection bypass flaw that enables SYSTEM-level access on Windows Server 2025. The vulnerability, tracked as CVE-2026-24294, abuses a feature introduced in Windows 11 24H2 and Windows Server 2025 that allows SMB connections over arbitrary TCP ports.
Impacket is a versatile, dual-use tool that uses Python-based scripts to exploit legitimate Windows services and protocols... threat actors frequently use psexec.py, smbexec.py, and wmiexec.py scripts within Impacket to execute code remotely on Windows systems without additional payloads or tools.
52 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT10 exploited a vulnerability in the web interface of a security tool, planted a version of the ASPXCSharp web shell, and then used a tool called Impacket to scan a target company's internal network.
Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Impacket activity was detected in the organization’s network, indicating its use of Windows network protocol interactions. The observed command lines align with Impacket's smbexec script, enabling a semi-interactive shell via SMB.
When compromising Windows Domain Controllers servers, the group harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised DC to locally decrypt it.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Description: A similar approach to smbexec but executing commands through WMI.
The attacker executed commands on the Active Directory Domain Controller... using a variation of this script called atexec-pro.py... It then creates a scheduled task... configured to run a single command through the Command Prompt (cmd.exe) with the highest permissions available (NT AUTHORITY\SYSTEM).
The attacker executed commands on the Active Directory Domain Controller... using a variation of this script called atexec-pro.py... It then creates a scheduled task... configured to run a single command through the Command Prompt (cmd.exe) with the highest permissions available (NT AUTHORITY\SYSTEM).
The attacker executed commands on the Active Directory Domain Controller... using a variation of this script called atexec-pro.py... It then creates a scheduled task... configured to run a single command through the Command Prompt (cmd.exe) with the highest permissions available (NT AUTHORITY\SYSTEM).
One of the most frequently referenced tools is secretsdump.py from Impacket, which is used to extract password hashes and NTLM credentials.
Shortly after the backdoor established C2 communications, Sophos observed a likely DCSync attack to retrieve user credentials
When opened, the HTML file triggered a system connection attempt to a Server Message Block (SMB) server via a meta refresh to a file scheme URI ending in .txt.
Impacket: used for NTLM-relay attacks for lateral movement after getting initial access
Microsoft stated that the threat actors used Impacket tools to execute the malware.
They primarily use the SMB protocol to move between hosts. | Remote Services: SMB/Windows Admin Shares T1021.002
Drawback is it needs DCOM, hence, I have to be able to access DCOM ports at the target machine.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
95 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as an example string for query-language starts-with-any matching; no malicious use or specific activity is discussed.
Offensive post-exploitation toolkit used to interact with compromised systems and extract data.
Offensive post-exploitation toolkit used after VPN compromise for lateral movement, protocol abuse, configuration retrieval, and tunnel establishment.
Framework used post-compromise for lateral movement and NTLM relay abuse.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.