Responder

MITRE

Malware Type:
Tool

First seen:
Unknown

Last seen:
Unknown

Details:

Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)

Associated Techniques (2)

ID	ATT&CK	Tactics
T1040	Network Sniffing	-
T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	-

Used by Actors (3)

APT28
Nation-state

Ember Bear
Unknown

Lazarus Group
Nation-state

Metadata

ID:	752
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00