Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool
Summary: Hancitor, an information stealer and malware downloader run by the actor tracked as MAN1, Moskalvzapoe or TA511, began using Cobalt Strike as early as October 2020 and only sends it when it infects a host inside an Active Directory environment. From December 2020 into January 2021, infections also dropped a network ping tool that generated roughly 1.5 GB of ICMP traffic while pinging more than 17 million internal, non-routable IPv4 addresses, saving results to result.txt in the same directory as the Hancitor Word document.
What's compelling: A single infected workstation can sweep more than 17 million internal addresses in about an hour, handing the actor a map of your Active Directory environment before Cobalt Strike and follow-on tools like NetSupport Manager RAT arrive - and the tool's 1.5 GB of ICMP traffic is the kind of signal most networks are not watching for.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026