🧰 Impacket

The items that name it 31

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
  articleas tools2026-10-22It is written here as Impacket (run by ARTEX worker agents).

  run by ARTEX worker agents

• Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active Directory
  writeupas tools2026-10-12

  Its scripts are used by ADStrike to extract computer hashes during Timeroasting.

• M-med/Active-Directory-Simulation-Attack-
  repoas classification.technologies2026-10-04
• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas tools2026-09-28

  Toolkit used by the threat actor during hands-on-keyboard activity to copy legitimate software, the malicious DLL, and file archive from a network share and execute it

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeupas classification.technologies2026-09-28
• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 2
  writeupas classification.technologies2026-09-28
• The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  writeupas classification.technologies2026-09-21
• crypt0p3g/adnullenum
  repoas tools2026-09-17

  Python SMB library; adnullenum.py is built on it

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas tools2026-09-17

  Toolkit used for AD/Windows authentication attacks, including secretsdump.py for credential/hash extraction from ntds.dit and SAM.

• Field Notes: From AV Alert to Impacket
  writeupas classification.technologies2026-09-11
• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeupas tools2026-09-09

  open-source tooling deployed by UAT-11988 during pre-ransomware probing of endpoints

• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  articleas tools2026-09-01

  Publicly available reconnaissance utility used by the actor

• ADScanPro/Claude-AD
  repoas tools2026-08-24

  Python toolkit used for executing Kerberos/NTLM attacks and other AD exploitation tasks

• Dark-Moon
  repoas classification.technologies2026-08-05
• awesome-osint-arsenal
  repoas tools2026-07-31It is written here as Impacket (red team).

  red team

• aniqfakhrul/CVE-2026-54121
  repoas tools2026-07-23

  Python library for network protocol implementation (SMB, LDAP, Netlogon, Kerberos) used as a dependency of the PoC

• CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
  writeupas tools2026-07-09

  Tooling deployed against domain controllers, dropping RemCom-based binaries for remote execution; quarantined by Microsoft Defender in one case.

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas tools2026-07-01

  Hacking tool/framework used in the wild for lateral movement (e.g. dcomexec.py for DCOM-based execution)

• nikaiw/VMkatz
  repoas tools2026-05-22

  reference implementation by Fortra (originally Alberto Solino @agsolino) for NTDS.dit extraction and the pwdump output format

• elementalsouls/Claude-BugHunter
  repoas tools2026-05-22

  internal AD/post-exploit toolkit; explicitly outside this bundle's scope

• dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025
  writeupas tools2026-05-04

  Underlying framework credited (Fortra) supporting AD attack tooling used in the research.

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas classification.technologies2026-04-30
• The ADWS Architecture That Hides PowerShell AD Enumeration
  writeupas tools2026-04-08

  Referenced from Part 1 of the series; Python tool whose LDAP filters become bitwise operations in logs

• Local administrator account remote logon in Windows
  writeupas classification.technologies2026-01-31
• The (!FALSE) Pattern | Huntress
  writeupas tools2026-01-29

  LDAP reconnaissance tools discussed in Part 1 of the series, using OID-based filters transformed into bitwise operations in Event ID 1644

• SDFlags | Huntress
  articleas tools2026-01-15

  LDAP reconnaissance tooling referenced from prior parts of the series (OID-based filters causing bitwise transformations in Event ID 1644 logs)

• ESXi Exploitation in the Wild
  writeupas tools2026-01-07

  Used by the TA to attempt to change the Domain Admin password (blocked by MDE)

• The LDAP Whitespace Problem | Huntress
  writeupas tools2025-12-30

  collection of tools used by attackers (and referenced in tool findDelegation.py) that construct LDAP queries using bitwise operations instead of OID values

• The OID Problem: Writing LDAP Detections That Actually Work
  writeupas tools2025-12-16

  Tool suite used by adversaries and red teamers to perform LDAP reconnaissance against Active Directory

• Manual Configuration Manager (SCCM) credential harvesting
  writeupas tools2025-10-05

  secretsdump module used to extract DPAPI_SYSTEM keys from exported SAM/SECURITY/SYSTEM hives; dpapi module used to identify masterkey GUID, decrypt masterkeys, and unprotect/decrypt secret policy blobs

• WriteAccountRestrictions (WAR) – What is it good for?
  writeupas tools2025-10-01It is written here as Impacket (changepasswd.py).

  Reset and change account passwords via DCE/RPC