{
  "family": "attack",
  "sample_count": 14,
  "category": "hacktool",
  "description": "Attack (classified across antimalware research as Trojan:Win32/Attack and HackTool:Win32/Attack) is a modular post-exploitation attack framework and lateral movement utility. Used by red teams and threat actors alike, Attack incorporates automated port scanning, SMB credential spraying, pass-the-hash execution, and remote service creation routines. Once established on an initial foothold, Attack queries domain controllers, maps network subnet topologies, tests default administrative credentials, and injects secondary payloads into remote systems via WMI or administrative shares (IPC$, ADMIN$).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Attack",
    "HackTool:Win32/Attack",
    "Win32/Attack",
    "Attack Lateral Tool",
    "Trojan.Attack"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is HackTool:Win32/Attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attack is a post-exploitation lateral movement tool used by threat actors to scan internal networks and execute commands remotely."
      }
    },
    {
      "@type": "Question",
      "name": "How does Attack spread across internal corporate networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses SMB credential spraying, pass-the-hash authentication, and remote service installation over ADMIN$ shares."
      }
    },
    {
      "@type": "Question",
      "name": "What reconnaissance functions are built into Attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans TCP ports, discovers active hosts on local subnets, and queries Active Directory for domain user accounts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Attack execute code on remote endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via Windows Management Instrumentation (WMI) process creation and remote Windows Service control manager APIs."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect Attack lateral movement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor internal network traffic for anomalous SMB/RPC traffic, audit Event ID 4624/4625 logon events, and enforce network segmentation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1046",
    "T1021.002",
    "T1047",
    "T1543.003",
    "T1110.003",
    "T1078.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Port Scanning)",
      "tactic": "Discovery"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt any active outbound attacks (DoS) or lateral movement attempts.",
    "Upload the flagged file to a sandbox environment (like Any.Run or Hybrid Analysis) to determine its specific capabilities and true malware family.",
    "Analyze EDR process tree logs to identify how the 'Attack' file was introduced to the system (e.g., downloaded by a browser, dropped by another process).",
    "Review firewall and IDS/IPS logs for anomalous outbound traffic originating from the isolated host immediately prior to the alert."
  ],
  "what_to_avoid": [
    "Do not close the ticket simply because the file was quarantined; a generic 'Attack' alert often indicates a human adversary or a secondary payload executing on the host.",
    "Avoid assuming the flagged file is the root cause; it is frequently just a tool utilized by an already-established backdoor."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - HackTool:Win32/Attack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32/Attack"
    },
    {
      "name": "Trend Micro Security Research - HackTool.Win32.Attack",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hacktool.win32.attack"
    },
    {
      "name": "MITRE ATT&CK - Network Service Discovery (T1046)",
      "url": "https://attack.mitre.org/techniques/T1046/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}