NBTscan

MITRE

Malware Type:
Tool

First seen:
Unknown

Last seen:
Unknown

Details:

[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)

Associated Techniques (5)

ID	ATT&CK	Tactics
T1016	System Network Configuration Discovery	-
T1018	Remote System Discovery	-
T1033	System Owner/User Discovery	-
T1040	Network Sniffing	-
T1046	Network Service Discovery	-

Used by Actors (10)

Agrius
Unknown

APT39
Unknown

BackdoorDiplomacy
Unknown

Earth Lusca
Unknown

GALLIUM
Unknown

Lotus Blossom
Unknown

MUSTANG PANDA
Nation-state

Threat Group-3390
Unknown

Tonto Team
Nation-state

Turla
Nation-state

Metadata

ID:	760
Created:	13/01/2026 17:48
Updated:	21/04/2026 04:00