H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)

Labels

tool

15 recorded

Relationships

uses

Group

uses

from APT39

Group

uses

from BackdoorDiplomacy

Group

uses

from Earth Lusca

Group

uses

Group

uses

from Lotus Blossom

Group

uses

from Mustang Panda

Group

uses

to Network Service Discovery

Technique

uses

to Network Sniffing

Technique

uses

to Remote System Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

from Threat Group-3390

Group

uses

from Tonto Team

Group

uses

from Turla

Group

5 external

References

mitre-attack

S0590

Debian nbtscan Nov 2019

https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html

FireEye APT39 Jan 2019

https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html

SecTools nbtscan June 2003

https://sectools.org/tool/nbtscan/

Symantec Waterbug Jun 2019

https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments