ResponderMalware
- spiderlabs responder
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.From MISP Galaxy
Last reported 2 days ago, by SecurityWeek11 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1550.002Pass the Hash
“To note, these uncovered NTLM hashes can be further used by a threat actor in pass-the-hash attacks, offline attempts to crack the hashes, or further post-exploitation.”
- T1552.004Private Keys
“Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys”
- T1684Social Engineering
“Think of it as a social engineering trap aimed at job seekers and companies alike.”
- T1003OS Credential Dumping
“OS Credential Dumping - ATT&CK T1003”
- T1014Rootkit
“Rootkit”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Cisco Patches 34 Vulnerabilities Across Multiple Products“Cisco patched nine CVEs in Unified Communications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Editio…”
-
Múltiples vulnerabilidades en productos de Cisco“Cisco Emergency Responder.”
-
Multiples vulnérabilités dans les produits Cisco (22 octobre 2026)“Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection versions postérieures à 14 et antérieures à 15SU5”
-
Cisco security advisory (AV26-1073)“Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection Release”
-
Cisco Unified Communications Products Security Hardening Release: October 2026“As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (U…”
-
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use“…025-2479, a SQL injection vulnerability that can allow unauthorized manipulation of databases; the adversary-in-the-middle (AitM) tool Responder; impacket-partial-mic, which can be used for NTLM authentication relay attacks; Ligolo-ng, which establishes tunnels into compromised n…”
-
Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix“An attacker may be able to capture it with tools like Responder, then use it in follow-on activity such as NTLM relay attacks or offline password-cracking attempts, depending on how the target environment is configured.”
-
Making Sense of Alphabet Soup: 16 Security Terms and Acronyms You Should Know“Incident Responder”
-
Best Practices to Reduce Your Attack Surface“In a recent episode of Tradecraft Tuesday, Huntress' UK ThreatOps Center Manager Dray Agha and Senior Incident Responder Harlan Carvey discussed the need to leverage an accurate asset inventory as a first step in reducing an organization’s attack surface.”
-
Everything We Know About CVE-2023-23397“Observing the attack chain, we uncovered and validated the same indicators and artifacts that ACE Responder saw.”
-
Gifting User Passwords to Adversaries With NPPSPY“Some tools, like Responder, let the threat actor listen network-wide and pick up some hashes that are whizzing around the Active Directory.”
Indicators in its reports
named in the reports above- risks[.]itin 1 report
- delivr[.]toin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.