Active Scanning: Vulnerability Scanning

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan target infrastructure to identify potential vulnerabilities and to enumerate services and endpoints.^[2]

APT28 has performed large-scale scans in an attempt to find vulnerable servers.^[3]

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.^[4]

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.^[5]

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).^[6]

During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.^[7]

Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.^[8]

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.^[9]

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.^[10]

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.^[11]

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.^[12][13]

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.^[14]

During SharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.^[15]

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.^[16]

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.^[17]

Volatile Cedar has performed vulnerability scans of the target server.^[18][19]

Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.^[20]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.