Skip to content

Impacket

Software · ATTACK:enterprise:S0357

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0357",
  "title": "Impacket",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0357",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--26c87906-d750-42c5-946c-d4162c73fc7b",
  "external_id": "S0357",
  "domain": "enterprise",
  "created": "2019-01-31T01:39:56.283Z",
  "modified": "2026-05-12T15:12:00.740Z",
  "version": "1.8",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Impacket Tools",
      "url": "https://www.secureauth.com/labs/open-source-tools/impacket"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1557.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0318431e-ad44-44c7-97be-686d4efe79f4

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03fb981b-6ee6-4490-ab5d-d671691abdf6

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055b4a0f-99aa-4d61-9aa4-a48fff427eb3

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--191d6679-d6a8-42e3-b5ff-84a8d5bfb1dd

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--205c5e6d-90c1-4369-98ee-9968f87d687c

DFIR Phosphorus November 2021

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2479e29e-c1a3-4cc9-b059-b3e15ac44428

apt41_dcsocytec_dec2022

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--373f6c02-459f-4d19-b8a6-6ae02e9738f7

Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49cc1b92-9460-4cdf-9b68-ebade6122990

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fd56621-eb11-43b9-b90f-e6739af43660

Tarrask scheduled task

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529664ab-4c44-4608-91e9-65dde54d0865

Cisco LotusBlossom 2025

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565f6cdf-e29b-430d-8b42-e0b0b93fa994

Unit42 Emissary Panda May 2019

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d4113cb-f652-4214-9585-388422528960

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1558.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6336e5f0-11ec-453b-bba9-1b2e9ea0fab3

Kerberos GNU/Linux · on security kerberos linux

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--640596c4-55d0-4d7d-a734-b4cfb864c9f5

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68ece5ad-73bd-4562-ac08-877bd1e18f79

Core Security Impacket · US-CERT TA18-074A

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d0fb103-d6f6-4259-a62f-296735020176

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e1e5bab-151b-4be9-9c96-5cb4c66ff540

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78daa7e5-f5e5-452b-a7fd-cece272294fd

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a5d3c81-084a-413f-b696-8d7753a40e14

rapid7-email-bombing

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--891f701a-b0d3-408a-8e2c-e9d9e727930e

Impacket Tools · Sygnia VelvetAnt 2024A

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad9f56c2-efb9-421e-99f5-d82396f89440

Sygnia Emperor Dragonfly October 2022 · Microsoft Ransomware as a Service

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b39c536a-55f1-485a-8235-24acb39d0be6

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b58c89b5-cade-4622-b0bc-5d9a921afc60

Sygnia VelvetAnt 2024A

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0956230-5ac8-49ce-9491-37d9171d926b

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c93cacac-5ecf-49cb-8377-18e319545329

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbfd307e-ab23-49d0-bda0-83e883d4851a

FoxIT Wocao December 2019

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d430bf8d-cbe9-4f0d-8040-7f7d66fcc204

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d61f5cc3-e075-4a5b-ac7c-e77feac1d310

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de1d9450-317d-42e1-af71-8f531408e5c6

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1a185d9-dbe1-4466-8a20-67263ad223da

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4c6b2e0-e644-4bb6-b2d0-f5a757ed9485

Microsoft Prestige ransomware October 2022

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7169878-e45d-40ec-a579-6dd12d710cc3

Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1db30cc-c6c0-4ffd-8896-ff6beecae653

Sygnia VelvetAnt 2024A

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2d2ca45-02eb-4afb-a084-82f9823088b8

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--febe1cf5-d8b5-4218-b32d-1e9ea10eab7f

Bitdefender Sardonic Aug 2021 · Bitdefender FIN8 July 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.