Log in Request a demo

Malware profile

Impacket

Impacket is a free, open source set of Python modules for working with network protocols.

In short

Impacket is a free, open source set of Python modules for working with network protocols. It includes tools for running commands on remote machines, dumping Windows credentials, working with Kerberos tickets, sniffing traffic and relaying logins. Defenders see it mostly because attackers, including state actors and ransomware groups named in CISA advisories, use it once they are inside a network.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsImpacket
  2. Techniques11ATT&CK techniques listedCredential Access · Execution · Lateral Movement
  3. Linked Groups9groups that use itAPT29 · APT35 · APT41

In one minute

What it is
An open source Python toolkit for working with network protocols, abused by attackers after they get into a network.
What it does
Runs commands on remote machines, dumps credentials, works with Kerberos tickets, sniffs traffic and relays logins.
Who uses it
Attributed by CISA to Volt Typhoon (AA23-144A, May 24, 2023) and Andariel (AA24-207A, July 25, 2024). CISA and the FBI also name it in ransomware advisories (BianLian, Akira, LockBit). MITRE lists many more groups, mostly from vendor reports.
How it gets in
Not an entry method. CISA describes attackers using it after access, with existing compromised credentials, to move between systems.
What to do first
Enforce phishing-resistant multifactor authentication, limit remote admin tools and watch for unusual Python and remote command use, as CISA advises.

What it does

Impacket is not malware on its own. MITRE describes it as an open source collection of modules, and CISA and partners list it among the "open-source and dual-use tools" used by an attacker group. Because it is public, it can be used by many different actors.

CISA explains that, through the Windows command shell, a user with valid credentials can run commands on a remote device using the Windows management protocols that enterprise networks need. That is why its use is hard to tell apart from normal activity without careful logging.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
ImpacketMITRE ATT&CK software S0357 and the CISA advisories AA22-277A, AA23-144A, AA24-038A, AA23-136A, AA24-109A, AA23-165A and AA24-207A[1, 2, 3, 4, 5, 6, 7, 8]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    The SecretsDump and Mimikatz modules inside Impacket can dump credentials to get account names and passwords.[1]

  • OS Credential Dumping: Security Account Manager T1003.002

    The same credential dumping modules can pull account and password data from the Security Account Manager.[1]

  • OS Credential Dumping: NTDS T1003.003

    The credential dumping modules can read account and password data from NTDS.dit. CISA and the FBI saw BianLian use secretsdump.py against a domain controller.[1, 5]

  • OS Credential Dumping: LSA Secrets T1003.004

    The credential dumping modules can also collect account and password data from LSA secrets.[1]

  • Network Sniffing T1040

    Impacket can sniff network traffic through an interface or a raw socket.[1]

  • Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay T1557.001

    Modules such as ntlmrelayx and smbrelayx can gather NetNTLM credentials for cracking or relay attacks that can give code execution.[1]

  • Steal or Forge Kerberos Tickets: Kerberoasting T1558.003

    Modules such as GetUserSPNs can list Service Principal Names for user accounts, in a format that cracking tools can use.[1]

  • Steal or Forge Kerberos Tickets: Ccache Files T1558.005

    Tools such as getST.py and ticketer.py can steal or forge Kerberos tickets in ccache files, given a password, hash, aesKey or TGT.[1]

Execution

  • Windows Management Instrumentation T1047

    The wmiexec module runs commands through WMI. CISA saw wmiexec.py and smbexec.py used in a defense industrial base network.[1, 2]

  • System Services: Service Execution T1569.002

    Impacket has modules that copy other service execution tools such as PsExec.[1]

Lateral Movement

  • Lateral Tool Transfer T1570

    MITRE says its wmiexec command was used to stage and run payloads remotely in victim networks.[1]

How it spreads

The sources do not describe Impacket as spreading by itself. In advisory AA22-277A, CISA says the actors used existing, compromised credentials with Impacket and tried to move to another system. In advisory AA23-136A, CISA and the FBI say BianLian actors used an Impacket tool, secretsdump.py, to move to a domain controller and collect credential hashes.

Timeline

  1. April 2021

    Impacket used in a defense network

    In an incident later described by CISA, APT actors used Impacket for network exploitation activities on a defense industrial base organization's network. The actors are not named.[2]

  2. November 2021 through January 2022

    CISA incident response

    CISA responded to APT activity on the network of a Defense Industrial Base Sector organization. CISA says likely more than one APT group was present.[2]

  3. October 4, 2022

    CISA advisory AA22-277A

    CISA, the FBI and the NSA published "Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization".[2]

  4. May 24, 2023

    Volt Typhoon advisory

    CISA and partners published AA23-144A on a PRC state-sponsored actor also known as Volt Typhoon. It says the actor regularly uses Impacket's wmiexec and points to AA22-277A for detecting Impacket.[3]

  5. June 14, 2023

    LockBit profile

    CISA published its profile of LockBit, which lists Impacket among the tools used for lateral movement.[7]

  6. February 7, 2024

    Volt Typhoon in critical infrastructure

    CISA and partners published AA24-038A, which says industry partners observed Volt Typhoon leveraging Impacket.[4]

  7. July 25, 2024

    Andariel advisory

    The FBI, CISA and partners published AA24-207A, listing Impacket among open-source and dual-use tools used by the North Korean group known publicly as Andariel.[8]

  8. November 13, 2025

    Akira advisory update

    CISA and partners updated AA24-109A with new activity, saying Akira actors use Impacket to run the remote command wmiexec.py.[6]

Detection and defense

  1. Enforce strong logins

    CISA, the FBI and the NSA advise phishing-resistant multifactor authentication on all accounts, and resetting all accounts used for login after an intrusion, because stolen credentials are what Impacket needs.[2]

    Counters: T1003.003 T1558.003 T1047

  2. Limit remote admin tools

    Reduce the number of remote access tools and who can use them. Watch the use of scripting languages such as Python and PowerShell by both authorized and unauthorized users.[2]

    Counters: T1047 T1569.002 T1570

  3. Segment the network

    Split the network by role and function. CISA says this limits lateral movement, privilege escalation and exfiltration.[2]

    Counters: T1570 T1047

  4. Use EDR for lateral connections

    CISA says endpoint detection and response tools are particularly useful for finding lateral connections, because they see which network connections are normal for each host.[2]

    Counters: T1047 T1569.002 T1570

  5. Watch for suspicious account use

    Look for logins from unusual VPN or hosting addresses, impossible travel, one address used across many accounts and unusual use of dormant, service or administrator accounts.[2]

    Counters: T1047 T1569.002

  6. Protect domain controllers

    CISA advises hardening domain controllers and monitoring event logs for ntdsutil.exe and similar processes to protect the ntds.dit database.[3]

    Counters: T1003.003

  7. Use the official detection resources

    AA22-277A carries malware analysis report MAR-10365227-1 with YARA rules and STIX indicator files. AA23-144A tells readers to use AA22-277A to detect Impacket.[2, 3]

    Counters: T1047 T1003.003

Questions

What is Impacket?

An open source collection of Python modules for building and working with network protocols. MITRE says it contains tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing and relay attacks.

Is Impacket malware?

Not by itself. MITRE lists it as a tool, and CISA and partners call it one of the open-source and dual-use tools used by an attacker group. What matters is who is running it.

Who uses Impacket?

CISA names Volt Typhoon (AA23-144A) and Andariel (AA24-207A), and lists it in advisories on BianLian, Akira and LockBit. MITRE also lists groups such as APT29, APT41, Magic Hound, Mustang Panda and Sandworm Team, mostly from vendor reports.

Which Impacket tools did CISA see in use?

In AA22-277A, CISA saw wmiexec.py and smbexec.py, which run commands through WMI and SMB. In AA23-136A, the FBI saw secretsdump.py used to collect credential hashes from a domain controller.

Where are the official detection resources?

CISA advisory AA22-277A carries MAR-10365227-1 with YARA rules and STIX files. CISA's AA23-144A points readers to it for detecting Impacket.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. Akira ransomware advisory AA24-109A: stages and tools October 2026
  3. Software Shared Across ATT&CK Groups: Reuse Study October 2026
  4. Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape March 2026
  5. APT35 Threat group
  6. Ember Bear Threat group

Sources

  1. Impacket, Software S0357 MITRE ATT&CKSupports: Description, platforms, techniques and the groups MITRE lists for Impacket.
  2. Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization (AA22-277A) CISA with FBI and NSASupports: Impacket use, wmiexec.py and smbexec.py, timeline, detection and mitigation advice.
  3. PRC State-Sponsored Cyber Actor Living off the Land to Evade Detection (AA23-144A) CISA and partnersSupports: Volt Typhoon use of Impacket and pointer to detection guidance.
  4. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A) CISA and partnersSupports: Volt Typhoon use of Impacket observed by industry partners.
  5. Understanding Ransomware Threat Actors: LockBit (AA23-165A) CISA and partnersSupports: Impacket listed among LockBit tools.
  6. North Korea Cyber Group Conducts Global Espionage Campaign (AA24-207A) FBI, CISA and partnersSupports: Impacket listed among tools used by the group known as Andariel.
  7. Volt Typhoon, Group G1017 MITRE ATT&CKSupports: MITRE lists Volt Typhoon as a user of Impacket.
  8. Mustang Panda, Group G0129 MITRE ATT&CKSupports: MITRE lists Mustang Panda as a user of Impacket.
  9. Magic Hound, Group G0059 MITRE ATT&CKSupports: MITRE lists Magic Hound, also named Charming Kitten, as a user of Impacket.

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Ember Bear

The US, UK, EU and Estonian governments attribute this activity to GRU Unit 29155, a Russian military intelligence unit, and MITRE tracks it as Ember Bear. It is described as using public tools and flaws in internet-facing systems to spy, leak data and wipe data, with a focus on Ukraine and those who aid it.

Read more

Threat group

HAFNIUM

Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as directed by officers of China's Ministry of State Security, HAFNIUM is the name given to the campaign that exploited Microsoft Exchange Server flaws in early 2021. MITRE describes it as a likely state-sponsored espionage group that targets US universities, law firms, defense contractors and research bodies.

Read more