com homework ip scanner

is a powerful IP address scanner for local area network (LAN). This application will help you find all IP addresses, MAC addresses and shared folders of computers on your wired or wireless (Wi-Fi) network. The program scans network and displays your network computers in an easy to read, buddy-list style window that provides the computer name, IP address, MAC address, NIC vendor, OS version, logged users, shared folders and other technical details for each computer. It is able to monitor your external IP address and send email notifications when it changes. MyLanViewer Network/IP Scanner can also turn on and off remote computers, view and control your shared folders, terminate user sessions, show netstat information , detect rogue DHCP servers and other network tools. The software can monitor all devices (even hidden) on your subnet, and send alerts when the new devices will be found (for example, to know who is connected to your WiFi router or wireless network). The program easy to install and use, and has a user-friendly and beautiful interface.

While downloading Advanced IP Scanner, please feel free to browse our other products.

If downloading fails to start, click here

Reliable remote desktop software for IT pros

Radmin is one of the most secure and reliable remote access software products today.

Connect remote computers to one local network

Radmin VPN is a free program that allows users to securely connect computers, located behind firewalls.

Spelling Error

Offer a solution *

Select language:

IT Tools  > IP Scanner

Discover the devices on your network by scanning IP ranges – with detailed hardware and software info and used with Help Desk

Go to IP Scanner Opens a new window

Basic scan or detailed info

Discover the devices on your network automatically with the Spiceworks IP Scanner for basic information like OS and MAC Address. Or get detailed hardware and software information on your workstations and servers like CPU, storage, memory, installed software, serial number, and lots more. Get the information you need, with minimal setup!

Other tools you may be interested in….

Cloud help desk.

Manage your users’ IT needs with help desk software that’s easy to setup and use.

Support Your Users

Easily monitor device health and get customized reporting, software tracking, and more.

Inventory Your Network

Connectivity Dashboard

View your users’ connectivity and speed to their applications in a single real-time view.

Troubleshoot Faster

How do you use IP Scanner?

IP Scanner is a cloud tool that scans your local network and returns a sortable list of the devices it discovers. Devices can be filtered, searched, and exported to CSV. By default, it detects and scans a local subnet, though you can also define a custom IP range.

What details does the IP Scanner return?

The IP Scanner lists each device’s hostname, IP address, vendor, OS, MAC address, description, open ports, and if it’s up or down. The kind of data returned depends on the type of device being scanned.

Add agents to your servers and workstations to get more detailed information like CPU, storage, memory, and network adapter details. You can even see the tickets for each device.

How do you set up the IP Scanner?

IP Scanner uses a small downloadable scan agent to give it access to your local network. To get started click Download to install the scan agent. A wizard will quickly step you through installation.

A browser page will launch and prompt you to scan the detected  IP range Opens a new window . You can customize the IP range that will be scanned if the default range doesn’t discover all of your devices.

When you’re ready to take your device information collection to the next level, go ahead and click the Agent Download button, then choose Download a Collection Agent. You can get the agent for both Windows and Mac. Then you’ll just copy the agent installer to each device you want to track. Want to save even more time? You can use Group Policy (or whatever 3rd party software distribution service you prefer) to deploy the agent in your network.

Why should you use the IP Scanner?

Document your it devices.

Rapidly growing network? Finance asking for an exhaustive list of workstations connected to the network? In minutes the IP Scanner builds a list of everything it finds on your network and lets you export and share that list of devices. Add the agent to get even more details – no scheduling needed!

Scan your network for unknown devices

The IP Scanner will quickly build a list of devices on your network where you may discover something from an unexpected or unwanted vendor, or any other device that shouldn’t be there. Start tracking your investigation, information and steps taken within the tool itself, by taking advantage of the included  Help Desk .

Find and fix security holes

How many machines are (still) running XP or some other ancient OS? Which workstations have ports 3389, 80 or 443 opened? What about other completely unexpected ports that are wide open? Assign the OS upgrades to a team member and create tickets for those open ports before the next fire hits.

Troubleshoot user issues

Are your users complaining about slow computers, or even worse, crashes? Get the latest, up-to-date details about their computer, with IP Scanner. See if there is not enough disk space or memory or if the software installed by the user last week corrupted the installation of legit software. Quickly create a ticket to address the problem.

The Best Network Scanners – Network Analysis & Management Tools

To monitor your network you need to be able to regularly scan new devices.

Network scanners make it possible to discover UDP/TCP services running on the devices, identify the OS systems, and recognize filtering systems between your device and targeted hosts, and more.

As part of our comparison, we’ve looked out for tools with automated scanning including tools that can take network inventories and vulnerability scanners that can discover vulnerabilities and misconfigurations. We’ve also prioritized tools with features like notifications and reporting that enhance the overall monitoring process.

Here’s our list of the best network scanners, network analysis & management tools:

• ManageEngine OpUtils (FREE TRIAL) This tool stands out for its robust network scanning capabilities and comprehensive IP address management. Start a 30-day free trial .
• Paessler PRTG Network Monitor (FREE TRIAL) Network monitoring software with automated network discovery, custom dashboards, notifications, reports, maps, and more. Start a 30-day free trial .
• Site24x7 Network Monitoring (FREE TRIAL) A collection of network monitoring tools including regular system scans to identified connected devices and records their attributes and statuses. This is a cloud-based service. Start a 30-day free trial .
• ManageEngine Vulnerability Manager Plus (FREE TRIAL) A package of security tools that is centered on a vulnerability scanner and includes system protection measures, such as a patch manager. Installs on Windows and Windows Server. Start a 30-day free trial .
• SolarWinds Network Performance Monitor Easy to configure with an autodiscovery feature that can map your network, customizable dashboards, alerts, and more.
• Intruder Cloud-based vulnerability scanner with automatic scanning, automated exposure analysis, Slack and Jira integrations, an API, and more.
• Acunetix A network security scanner that can detect over 50,000 vulnerabilities and misconfigurations with a dashboard, reports, and more.
• Spiceworks IP Scanner Cloud-based IP scanner software that can scan IP ranges, display performance and availability data, and more.
• OpenVAS Open-source vulnerability scanner for Linux that comes with over 50,000 tests, a web interface, scanning wizards, and more.
• Angry IP Scanner Easy to deploy open-source network scanner with robust community-led support and documentation.

The Best Network Scanners & Monitoring Software

Our methodology for selecting a network scanner.

We reviewed the market for network analysis and management tools and assessed the options based on the following criteria:

• A tool that can locate every device connected to the network
• A system that can check that all devices are running properly
• A tool that includes security checks on device settings
• An integrated, or associated patch manager
• Thorough action logging for data protection security standards compliance
• A free trial for a no-risk assessment period or a money-back guarantee
• A good deal on the price, judging by the quality of services offered

1. ManageEngine OpUtils (FREE TRIAL)

ManageEngine OpUtils is a comprehensive network scanner designed to provide detailed insights into active hosts and network resources. Its advanced network scanning capabilities combine IP scanning, port scanning, and device scanning, enabling efficient management of computing environments, active devices, current users, network health, and related metrics.

Key Features:

• Advanced Network Scanning: Efficiently scans network devices and identifies vulnerabilities.
• IP Address Management: Provides detailed tracking and management of IP addresses.
• Switch Port Mapping: Maps switch ports to connected devices for easy monitoring.
• Rogue Device Detection: Identifies unauthorized devices on the network.
• Comprehensive Reporting: Generates detailed reports for network analysis.

Why do we recommend it?

ManageEngine OpUtils is recommended for its robust network scanning and IP address management capabilities. The tool provides detailed insights into network infrastructure, ensuring efficient management and troubleshooting. Its user-friendly interface and comprehensive reporting features make it a top choice for network administrators. Additionally, the ability to detect rogue devices enhances network security.

With features like a code-free intuitive UI, granular reporting, threshold-based alerts, scheduled scans, IPv4 and IPv6 support, graphical network widgets, and 30+ network tools, OpUtils makes enterprise network scanning practical and efficient. This tool automates network IP address scanning, manages subnets with subnetwork scanning, and ensures end-to-end network device connectivity.

Who is it recommended for?

ManageEngine OpUtils is ideal for network administrators and IT professionals who need to manage and analyze network infrastructure efficiently. It is particularly useful for organizations with large and complex networks requiring detailed IP address management. The tool is also suitable for those looking to enhance network security by identifying unauthorized devices. Additionally, it benefits users who prefer seamless integration with other ManageEngine products.

OpUtils also enhances network security by detecting rogue devices and setting role-based access management, providing a powerful solution for network administrators.

• Extensive Network Scanning: Thoroughly scans and analyzes network devices for vulnerabilities.
• User-Friendly Interface: The interface is intuitive and easy to navigate.
• Detailed Reporting: Provides comprehensive reports for better network analysis.
• Rogue Device Detection: Effectively identifies unauthorized devices on the network.
• Limited Customization: Some features lack advanced customization options.

ManageEngine OpUtils Start a 30-day FREE Trial

2. Paessler PRTG Network Monitor (FREE TRIAL)

Paessler PRTG Network Monitor is a free network monitoring tool that comes with an autodiscovery feature. Paessler PRTG Network Monitor can scan for devices by IP address range and automatically add them to be monitored with sensors or network maps. Users can configure scanning intervals to ensure that the network inventory is periodically updated with new devices.

• Network discovery: Creates a network inventory from scan data
• Network mapping: Generates a network map from inventory records
• Availability testing: On-demand Ping testing

Paessler PRTG Network Monitor offers a network monitoring tool that can be extended to monitor servers, services, applications, and cloud platforms. Each buyer pays for an allowance of sensors. The package has a large number of these monitors and turning each one on uses up part of the sensor allowance.

When it comes to monitoring, users can create custom dashboards to monitor devices. You can also choose between a range of out-of-the-box sensors to monitor device performance. For example, you can use the SNMP Traffic Sensor to monitor the traffic in and out of a device. There is even a mobile app for iOS and Android , which allows you to monitor performance from a smartphone or tablet.

A highly configurable alerts system provides you with notifications on performance changes as they occur. Alerts can be generated including SMS messages, emails, push notifications, Slack messages, and more. These ensure that you never miss out on important information.

Paessler PRTG Network Monitor is a top network monitoring tool for a reason. It has all the built-in customization and a clean user interface to suit most users. There is even a freeware version that supports up to 100 sensors .

This package is suitable for businesses of all sizes. There is a free edition that lets you turn on 100 sensors without paying. The minimum package that you can buy is for 500 sensors and then businesses can choose to buy more, up to accessing all of the monitors in the package.

• Network and internet tests: Check on connections to remote locations
• Path testing: Offers a Traceroute utility
• Free edition: Only activate 100 sensors and you never have to pay
• A very large package of tools: Choose carefully which sensors to activate

Paid versions start at a price of $1,750 (£1,411) for 500 sensors and one server installation. On-premises version requires Windows, Microsoft Windows Server 2019, 2012 R2 or Microsoft Windows 10. You can download the 30-day free trial .

Paessler PRTG Network Monitor Download 30-day FREE Trial

3. Site24x7 Network Monitoring (FREE TRIAL)

Site24x7 Network Monitor is a cloud-based service that is part of a platform of system monitoring tools. The plans offered by Site24x7 are:

• Website Monitoring
• Site24x7 Infrastructure
• Application Performance Monitor

All of these plans include the Network Monitor. There is no standalone subscription offer for the Network Monitor.

• A cloud-based system: A SaaS package
• Monitors networks: Installs a local agent
• Tests internet connections: Ping utility
• SNMP-device monitoring: Periodically polls device agents for status reports

The Site24x7 Network Monitoring module is a SaaS service that provides network discovery. Topology mapping, device status tracking, and traffic analysis. The service is able to gather log messages from around the network and they can be analyzed, filed, and forwarded. The package also provides ad-hoc connection testing utilities.

The Site24x7 system is all based in the Cloud except for an agent, which needs to be installed on a server connected to the enrolled network. The agent is a data collector and uploads statistics to the Site24x7 server for processing. It also acts as an SNMP manager . The Simple Network Management Protocol (SNMP) is widely implemented and all network devices are shipped with an SNMP agent pre-installed on them. The agent constantly scans the device and compiles a report, called a Management Information Base (MIB) . The MIB only gets sent out unless it is requested and it is the role of the SNMP Manager to issue that request.

The request that the Site24x7 data collector issues is sent as a broadcast, which is received by all devices on the network. Thus, the data collector doesn’t need to know the addresses of the devices in order to collect information – it learns the IP address and MAC address of each device from the MIBs that come back.

The Site24x7 Network Monitor interprets the attribute information in the MIBs into an inventory . The status information gets displayed on the dashboard as live performance data . The Site24x7 Network Monitor also generates a network topology map based on the network inventory.

The Site24x7 data collector reissues an SNMP request periodically and each batch of responses provides updates to both the network inventory and the network topology map. Agents are allowed to sends out a MIB without receiving a request. This is called a Trap and it signifies a serious problem with a monitored device. The Site24x7 Network Monitor interprets this into an alert , which appears on the dashboard and is also sent as a notification to technicians via SMS, email, instant messaging post, or voice call.

This system is delivered in plans that include full-stack monitoring services because they also include monitoring tools for servers and applications. Some plans also provide an APM and website analyzing tools. The plans are suitable for businesses of all sizes and offer good value for money.

• Full stack observability: Plans bundle together network, server, and application monitoring
• Device status alerts: Forwarded as notifications by SMS, email, or voice call
• Cloud storage included: Storage space for logs and metrics
• Port scanner: Ad-hoc or continuous scanning
• Part of a bundle: You can’t just subscribe to the network scanner

The Network Monitor is part of the Site24x7 Infrastructure package, which is available for a 30-day free trial .

Site24x7 Network Monitoring Start 30-day FREE Trial

4. ManageEngine Vulnerability Manager Plus (FREE TRIAL)

ManageEngine Vulnerability Manager Plus is a package of security services that is built around a vulnerability scanner. The server for this system installs on Windows and Windows Server . There are also agents for each device on the network that need to be installed and these are available for Windows , macOS , and Linux . The service coordinates all elements to create a central summary of malicious activity and that is accessed through the management console.

• Scans for endpoints: This package focuses on endpoint security
• Discovers roaming devices: Be aware of mobile devices on your premises
• Assess each device: SCans devices for security weaknesses

ManageEngine Vulnerability Manager Plus is a system-wide security scanner that implements preventative assessments of all services on a network. The tool provides more security services for endpoints than network equipment but it scans switches, routers, and other network hardware to identify and fix misconfigurations. The tool also assesses user accounts.

The package of services in Vulnerability Manager plus includes a live threat intelligence feed . Any new exploit that ManageEngine discovers is immediately shared among all Vulnerability Manager Plus users, triggering a system sweep to look for that problem. In the absence of any new information, the service automatically performs a vulnerability scan every 90 minutes . It checks on network appliances, such as firewalls as well as all endpoints.

The “Plus” features of this package include system hardening guides on device settings and a patch manager that makes a software inventory and automatically detects whenever patches and updates for those resources become available. The patch manager can be set to automatically apply new patches within allowed time windows.

As well as checking on services for endpoint, the protection system also scans through web services to protect any websites that your business runs.

ManageEngine offers a free edition of this tool and that is limited to monitoring 25 endpoints. The paid package is affordable and it is sized to be suitable for small businesses. Larger companies can access plans with more capacity and there is also a multi-site version available.

• 90-minute scan cycle: Repeatedly scans for devices and then assesses each of them
• Multi-OS protection: Examines endpoints running Windows, macOS, and Linux
• Patch management: Automatically updates outdated OSs and software
• Doesn’t assess mobile devices: The tool can discover mobile devices but it can scan them

Vulnerability Manager Plus is available in three editions: Free, Professional, and Enterprise . The free version is limited to monitoring 25 computers. The Professional edition covers one site and Enterprise edition covers WANs. Both paid systems are offered on a 30-day free trial .

ManageEngine Vulnerability Manager Plus Download 30-day FREE Trial

5. SolarWinds Network Performance Monitor

SolarWinds Network Performance Monitor is a network monitoring platform that automatically discovers and scans network devices . SolarWinds Network Performance Monitor’s Network Sonar Wizard takes you through the autodiscovery feature, and you can provide a list of IP addresses, IP range, or subnets to drive the discovery process forward.

• Autodiscovery: Creates a network inventory
• Network mapping: Generated from data in the network inventory
• Automated scanning: Repeated scans with SNMP
• Ad-hoc testing: A Ping utility
• Path analysis: Based on Traceroute

SolarWinds Network Performance Monitor is based around the Simple Network Management Protocol, which can provide a lot of information about each network device and it can also be activated on workstations and servers. This tool discovers all devices connected to the network, generates an inventory, and creates a topology map.

Network discovery can be run on a one-off basis or you can schedule future discoveries to add devices to your monitoring environment as you go. Discovered devices are also added to a network topology map where you can monitor applications and services (whether they’re based on-premises or in the cloud).

Once the devices have been added you can use SolarWinds Network Performance Monitor to track availability and performance through the dashboard. The dashboard is customizable and there is an alerts system with email and SMS alerts to keep you updated on network changes. You can also create reports for periodic updates.

This SolarWinds system is suitable for use by large organizations. The device monitoring service can be enhanced by adding on the NetFlow Traffic Analyzer. That tool provides traffic monitoring and the two services together allow path analysis and live data flow monitoring per link. This software runs on Windows Server.

• Constant device health checks: Provides live feedback in the console
• Alerts for device problems: Notifications by email or SMS
• Customizable screens: Use drag-and-drop widgets
• Reporting: Pre-written templates and customizable layouts
• Designed for mid-sized and large organizations: Too big for small businesses
• No SaaS version: Only available for installation on Windows Server

Prices start at $2,995 (£2,414). You can download the 30-day free trial .

You can expand your network performance tracking by adding on the NetFlow Traffic Analyzer , which communicates with switches and routers using flow protocols, such as NetFlow, IPFIX, sFlow, and J-Flow. SolarWinds provides both of these modules in one bundle called the Network Bandwidth Analyzer Pack . Both units run on Windows Server and they combine into a single dashboard. You can get the pack on a 30-day free trial .

6. Intruder

Intruder is a cloud-based vulnerability scanner that can automatically search your network for vulnerabilities. Intruder not only scans your network for weaknesses but provides automated exposure analysis to interpret the results for you as well. For example, rather than providing you with technical jargon, the tool will tell you in plain terms what the problem is, such as your database is exposed to the internet.

• Cloud-based service: You don’t have to install the software
• External scans: Provides attack surface scanning
• Network scanning: Through the installation of an on-site agent

Intruder is a vulnerability scanning service that is available in three plans. The base plan will only provide eternal scanning but the two higher plans include network scanning. This tool enables system administrators to examine network appliances and update their settings to make them harder for hackers to manipulate.

The platform scans your network whenever new vulnerabilities are released. Monitoring the latest threats ensures that you have some level of protection in place. There are also integrations with Slack and Jira so that you can receive updates on problems immediately.

To support the rest of your operations, Intruder comes with an API for a more efficient workflow and the option to export scan results to an external platform. The API makes it easier to integrate Intruder with the rest of your operations so that you can address vulnerabilities efficiently.

Intruder is quite expensive and small businesses will probably opt for the ManageEngine vulnerability scanner over the Intruder system. This package is strong at identifying weaknesses in Web application services, such as Web servers and cloud platforms. The most likely market for Intruder lies with the managers of websites and Web applications.

• Security service: Identify system, device, and endpoint security weaknesses
• Alerts for security weaknesses: Get notifications into Slack and Jira
• Penetration testing: Pay for extra scrutiny from a human pen testing team
• More than just a scanner: If you just want a network scanner, you would be paying for more than you need with this tool

Intruder is one of the top vulnerability scanning solutions for enterprises and DevOps teams. It not only can be used for vulnerability scanning but also comes with automated penetration testing as well. Pricing starts at $105 (£84.66) per month. You can start the 30-day free trial from this link here .

7. Acunetix

Acunetix is a network security scanner that lets you detect vulnerabilities in your network. Acunetix tests for over 50,000 known vulnerabilities and misconfigurations. When running scans, users can also see information on running services and discover open ports that leave the network at risk.

• Vulnerability scanner: Provides external attack surface monitoring
• Network scanning: With OpenVAS
• Security assessments: Identifies system security weaknesses

Acunetix is an external attack surface assessor but it can be extended by the integration of OpenVAS for network vulnerability scanning. The system is particularly strong as a Web application but it is also necessary for DevOps teams supporting these systems to ensure that their own systems are hardened against attack.

Scan results are displayed through the dashboard . The dashboard is simple to navigate and there is a Vulnerabilities tab that allows you to view a list of discovered vulnerabilities marked with icons that display the level of severity. You can also use the dashboard to generate reports .

Detecting misconfigurations with Acunetix is easy. You can use the tool to test for misconfigurations such as anonymous FTP access, weak SNMP community strings, poor proxy server configuration, weak TLS/SSL ciphers, and more. The range of issues you can detect gives you a wide layer of protection against attackers.

Acunetix is designed for the Web apps development community. The system can be integrated into a CI/CD pipeline as a continuous tester. The Ops part of the DevOps support provided by Acunetix includes its network vulnerability scanner. Access this system as a SaaS platform or install it on Windows, macOS, or Linux.

• Developer’s option: Provides continuous testing for CI/CD pipelines
• A range of tests: Provides both static and dynamic examinations
• Network service weaknesses: Identifies insecure SNMP transmissions
• Not a classic network scanner: This is a security system

Acunetix is a reliable network security scanning solution for enterprises. The software comes with free network scans for a year. Prices start at $4,495 (£3,624) for 1-5 websites. You can get a demo from this link here .

8. Spiceworks IP Scanner

Spiceworks IP Scanner is a cloud-based IP scanning tool that can scan IP ranges for devices. Spiceworks IP Scanne r scans for devices and then adds them to a network inventory. Through a dashboard, the user can monitor an overview of discovered devices.

• Online tool: Runs on a website
• Free to use: Sign up for an account that costs nothing
• On-demand discovery: Installs an agent then scans for equipment and logs them

The Spiceworks IP Scanner is a free online tool. You need to install an agent on one of your endpoints in order to get it to scan your network. You get a list of all devices on your network with their IP addresses and more details about the device that has the agent on it.

Information that can be viewed includes Name, IP addresses, Vendor, OS, MAC addresses, Open ports, Up/Down, and more. You can view performance data on CPU, memory, and storage. There is also a search function where you can search for information on a specific device.

When it comes to managing vulnerabilities, the main value of Spiceworks IP Scanner is its ability to detect issues like open ports or computers running outdated OS’ s. You’ll also be able to check the disk space and memory of devices that aren’t performing as they should be.

Anyone can use this tool. It is free and not complicated to set up. The tool will scan your network automatically when you access the IP scanner web page but it doesn’t operate continuously. Install the agent on all endpoints to get full inventory details.

• Device scanning: Detailed scans for each device that has an agent installed on it
• Software inventory: For endpoints that host agents
• Port scanning: Lists open ports
• Not continuous: Only launches on demand

Spiceworks IP Scanner is a great basic tool for creating a network inventory and monitoring basic information on performance and availability. The tool is easy to configure with an agent available for Windows and Mac. You can download the program for free from this link here .

OpenVAS is an open-source vulnerability scanner for Linux that includes over 50,000 vulnerability tests with unauthenticated and authenticated testing. The platform comes with a web interface , which enables you to run vulnerability scans without being limited to a desktop app.

• Highly respected: This tool is taught on cybersecurity courses
• Automated operations: The system works through a series of tests
• Scheduling possible: Can be set up to run repeatedly

OpenVAS is a free tool and is one of the leading network vulnerability testers. The tool is offered as an integration by Acunetix. This system allows you to set up different levels of scans and each process can take a long time to run. It is rare to let the system run through all of its tests.

When scanning your network, you can use OpenVAS’s Task Wizard to guide you through the scanning process. A simple scan allows you to enter an IP address of the machine and you will be able to view the results alongside a summary and visualizations .

More advanced scan options can be configured through the Advanced Task Wizard . The advanced wizard lets you set a task name, enter a configuration for the scan, schedule future scans, and more. These options give you the ability to scan for more issues that less regular/comprehensive scanning might miss.

Although the “VAS” in the name stands for “vulnerability assessment scanner,” this is a penetration testing tool rather than an automated system. This is because a full scan of a typical system would take a very long time to run, so it is more frequently used for specific tests.

• Device assessment: The package includes a list of 50,000 tests
• Adaptable operations: Only tests relevant to each device type will be applied
• Assessment reports: Get a breakdown of security vulnerabilities for each device
• No professional support: YOu have to rely on community message boards for help

OpenVAS is a superb choice for enterprises in search of an affordable vulnerability scanning and penetration tool. As the program is open-source it’s available for free (although there is a source version available called the Greenbone Source Edition). You can download the program for free here .

10. Angry IP Scanner

Angry IP Scanner is an open-source network scanner that can scan local networks and the internet by IP range. The software is easy to deploy and doesn’t require installation. Scan results can be viewed in a table format that breaks down information such as IP, Ping, Hostname, Ports, and more.

Key Features

• Free tool: There is no paid version
• Multiple OSs: Will run on Windows, macOS, or Linux
• Expandable: Install plugins for extra features

Angry IP Scanner is one of many free network scanners on the market that are based on Ping. One attribute that stands out about Angry IP scanner is that it will run on Windows, macOS, and Linux – most of its rivals only run on Windows.

You can enhance the basic features included with Angry IP Scanner with plugins . Plugins are available as jar files and include Pinger, Fetcher, Exporter, or Feeder . Each plugin adds a new feature. For example, Pinger allows you to ping the availability of an IP address.

On the other hand, Exporter allows you to export scan results . Exporting scan results is useful for analyzing scans in other external tools you use as part of your everyday operations. Angry IP Scanner supports exports in a range of formats including CSV, TXT, XML, or IP-port list files .

Angry IP Scanner is free to use, easy to install, and easy to use. This makes it suitable for use by any network manager or system administrator. The color-coded address status icon makes understanding IP address usage very simple, so you don’t need technical skills to understand what’s going on.

• Scan a range of devices: Run through a range of addresses or make the parameters so wide that the entire network gets scanned
• Port scanning: Tests the well-known ports
• Ping details: Response times and jitter data
• No graphics: Doesn’t produce charts or a network map

Angry IP Scanner is worth a look for enterprises that need a free network scanning solution. The platform is available on Windows, Mac, and Linux. You can download the software for free from this link here .

Choosing a Network Scanner & Monitoring Tool

Whether you’re looking for a scanner to locate vulnerabilities or for a tool to discover connected devices, the closer you monitor your devices and potential vulnerabilities the better you’re able to protect your network and stay safe from cyber attackers.

Our top picks for this list are ManageEngine OpUtils and Paessler PRTG Network Monitor for network monitoring and Acunetix for vulnerability scanning. Between them, these tools have everything you need to start maintaining an inventory of devices or scanning for weaknesses.

Network Scanners FAQs

What are 3 types of network scanning.

The three network scanning types are port scanning, network scanning, and vulnerability scanning. Port scanning identifies open ports, network scanning lists all IP addresses in use together with related device identifiers, such as hostnames, and vulnerability scanning works through a list of known system weaknesses to see if they exist in the present network.

What is a null scan?

A null scan is a probe to identify open ports. The scanning strategy gets its name because it is implemented with a TCP packet with a sequence number of 0 and no set flags. This packet is meaningless to the contacted device and so provokes an RST response. The response discloses the operating status of each responding port. This discovery technique is often used by hackers.

What are the network scanners for Bulk Extractor?

Bulk Extractor includes 24 scanners, including bulk , which activates all the 23 other scanners. Only one scanner directly relates to network data. This is the net scanner, which is a packet sniffer. Bulk scanner only searches through the device on which it is resident. It gets network packets data from virtual memory, which is those live packet traffic traveling in and out of the device. Packets are dumped to a file in libpcap format.

How do I block network scanners?

Prevent hackers from probing your network with a network scanner by installing a network firewall. The firewall should be a standalone device so that its activities don’t hijack the resources of a hosting server. Non-hardware firewall substitutes are available from cloud providers. These are called “edge services;” and they block network scanning strategies before they reach your network gateway.

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed .

SolarWinds Top 5 Essential IT Tools

Manage and monitor your network in one simple bundle.

• Help desk ticketing and asset management software
• Remote support and systems management solution
• Network configuration and automation software
• Safe file transfer management solution
• Network management and troubleshooting software

DOWNLOAD FREE TRIAL

Fully functional for 14 days

• Technical Specifications
• Software and Applications
• Guides and Diagrams
• Applications: Desktop
• Applications: Mobile
• General How to guides
• Troubleshooting
• Speco Webinars
• Speco Presents
• Diagrams and Accessories
• Request an Article
• Speco Technologies Knowledge Base

How to download and use the Speco Blue IP scanner tool

Use the ip scanner (on a windows machine) to find a blue series ip camera on the network..

• Click below to Visit the Speco Blue IP scanner download page

• On the desktop of the PC , double click on the Speco Blue IP scanner icon to open to application

• After launching the IP scanner, it will automatically scan and display the IP address of any Speco cameras on the network.   Double click on the camera you wish to access.

• Log-in to the camera using the credentials
• Username:  admin
• Password:  1234

It is advisable to change the password from the default password, Click here to check out the article 

Need Help with Your Homework ?

Your AI copilot for study

Question Answering & Homework Helper

QuestionAI App, with AI Powered Answers for your Questions & Summarizer, instantly solve all kinds of problems and summarize all kinds of texts and help to answer your questions with concise solutions. Choice of more than 10 million users. A marvelous homework assistant!

Why Use Question AI Tool?

Our Question AI has unique features and all free, also known as Homework AI.

Snapping & Problem Solving

Just take a picture of your math problems and then get the answers quickly! Wonderful Homework AI copilot.

24-hour AI copilot

Provides you with professional and concise solutions 24/7! Question AI is your good AI copilot.

Respond to your needs quickly. You can also upload PDF files with Question AI.

We can help summarize textbooks from any subject to make it clear and easy for you to understand.

Frequently Asked Questions

1. can question ai handle complex or technical language.

Yes, it can. The AI has been trained on a big dataset, so technical or complex data won’t be a problem. Question AI can handle any academic or technical langauge.

2. Can Question AI be used on mobile devices, or is it only available on desktop?

Question AI is accessible on both desktop and mobile. Question AI supports Windows and Mac systems as well as IOS and Android.

3. How fast Question AI generate an answer?

Within seconds. Never doubt Question AI's speed.

4. How many questions can Question AI tool handle at once?

There’s no limit. Question AI can handle several questions at the same time.

5. Can Question AI make several versions of the same text, each with a different level of detail?

Question AI can give you a longer or shorter text, depending on your wishes.

• The formula for the circumference of a circle is c 2 r where r is the
• Which inequality has no solution 6 x 2 x 3 3 4x 2 1 2x 2 x 6 x 20 x 9
• 25 which rule describes a transformation across the x axis x y x y x y
• 2 sqrt 3 sqrt 2 3 sqrt 2 3
• Sqrt 11 3 sqrt 22 sqrt 6
• 4 sqrt 8 times 3 sqrt 18
• 15 1 250 24 times 115 1 110 ldots
• 2 sqrt 5 sqrt 3 sqrt 5
• 6 tentukan hasil dari operasi hitung bilangan 17 times 12 18 22 jawab
• Component 4b peter s questions simplify each algebraic fraction q1 fra
• Sederhanakan bentuk bentuk akar berikut 1 sqrt 12 3 sqrt 75 5 sqrt 216
• C quad 1 frac 1 3 times frac 1 6
• 1 nyatakan tiap bentuk berikut dengan pangkat positif a a 5 f 2 a 4 b
• Bentuk sederhana dari frac left 4 x 3 y 2 z right 2 16 x 5 y 4 z 3 ada
• 9 a right circular cone is inside a cube the base of the cone is inscr
• Process living organisms maintain fairly constant
• Exam lesson name geological time exam number 700938rr
• True false question true false gluteal nerve nerve
• Following biomdecules typically conyerted energy human
• Question 7 1 point type glial cell help form part blood
• Following environmental influences except living
• Select types molecules cells use longterm energy storage
• Question 1 10 humans breathe oxygen release gas answer
• Organisms produce organic matter using external energy
• Enzymes able increase speed reaction accomplish tasks
• Tissue consists cells cylindrical shape striated fibers
• Term quotlatencyquot quotdormantquot describing virus
• Membrane proteins put two groups based protein
• Genus composed number similar kingdoms phyla species
• 103which following correct azygos system veins return
• Nevering 4 identifying battle stalingrad change fate
• Following agreement reached hitler stalls countries
• Part 4 complete following boxes using following
• Entition tion othe following contributed western
• Colosseum rome used romans early rocknroll concerts
• 4 age exploration 5 new technologies led age exploration
• 1 point civilization invented invented game inspiration
• Lbjs legislative program end poverty racial injustice
• Inalyzing eviden cebased data 8 section explored changes
• 3 evidence showed prosperity 1920s illusion prices
• Nguage arts 11 q2 cr proctored mark retum skywardtooele
• 11 briefly describe early history olympics dif fers
• President oversaw spanishamerican war grover cleveland
• Md hotel rwanda film video qs rwandan journalist
• President made final decision drop atomic bombs japan
• I say death penalty immoral mean according ethical
• Order public opinion guide government according authors
• According paul ricoeur 1986 first functional level
• Jonathan ladd maintains competition increased party
• 0207 stage 1 kohlbergs model ethical reasoning motivated
• Giving state governments greater discretion deciding
• 13 cartel controls oil production member nations thereby
• Quran 4524 says
• Traditional solution problem evil
• Appeals authority fallacy argument authority
• Governors compensation consist
• Expressed presidential power
• Israelites however still weak faith even great events
• 5 teleological argument
• International organizations help tibetans uyghurs need
• Price celery rises nothing changed supply side market
• Oo 2 select misplaced dangling modifier ksa select
• 10 5 points persons motives determined observing
• Identify main clause sentence decide subordinate clause
• Changes occur earth demeter mourning loss daughter earth
• Fix punctuation capitalization errors click quotsubmit
• Choosing right word following sentences underline word
• Complete sentence correct plural wharf salem maritime
• Main idea youth voices johnathon since 1882 panolian
• Return ngugi wa thiongo directions respond questions use
• Planet farthest sun ajupiter bsaturn curanus dneptune
• Methamphetamine differ amphetamines select one potent b
• Following explanatory thesis conventional farming
• Miranda rights including right remain silent apply
• D quotthe letters dillingham looked blurredquot 10 o
• What should an investor consider when making an investment check all t
• 1 when preparing a sanitizing solution you must a test the solution st
• Match each feature with the savings account type 1 basic savings accou
• What is the purpose of competition a to act as a regulating force in t
• The practical application of techniques and knowledge is called a comp
• Which of the following statements about scholarships is not truea they
• Which type of intellectual property can protect your company s logo a
• How has the internet changed shopping apex
• When a food safety inspector enters your establishment you should
• What flexibility assessment requires a partner a sit and reach b trunk
• What is one main objective in the studies of economics
• Acquiring storing and inventorying resources are part of which nims ma
• A collection of financial assets is known as an investor s mutual fund
• Which of these scenarios involves commodity money
• Lisa s considering whether creating a database would be beneficial for

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

Here are 54 public repositories matching this topic...

Borntoberoot / networkmanager.

A powerful tool for managing networks and troubleshoot network problems!

• Updated Aug 5, 2024

liamg / furious

😠 Go IP/port scanner with SYN (stealth) scanning and device manufacturer identification

• Updated Oct 2, 2022

vil / H4X-Tools

Open source toolkit for scraping, OSINT and more.

• Updated Jul 7, 2024

dwisiswant0 / cf-check

CloudFlare Checker written in Go

• Updated May 12, 2024

kiomarzsss / kscanner

Cloudflare Clean IP Scanner with SNI & Port

• Updated Apr 29, 2024

pojntfx / liwasc

List, wake and scan nodes in a network.

• Updated Feb 26, 2023

HalilDeniz / NetworkSherlock

NetworkSherlock: powerful and flexible port scanning tool With Shodan

• Updated Dec 28, 2023

csyezheng / ip-scanner

This script is used to find the fastest IP for a given site such as Google Translate, Cloudflare, GitHub, etc.

• Updated Jun 13, 2024

Jackeriss / one-scan

多合一网站指纹扫描器，轻松获取网站的 IP / DNS 服务商 / 子域名 / HTTPS 证书 / WHOIS / 开发框架 / WAF 等信息

• Updated May 11, 2021

thelinuxuser-choice / ip-tracker

python3 ip tracker with lot of informations

• Updated Mar 23, 2021

crowdsecurity / cs-wordpress-bouncer

CrowdSec is an open-source cyber security tool. This plugin blocks detected attackers or display them a captcha to check they are not bots.

• Updated Jul 26, 2024

sigoden / opscan

A open port scanner.

• Updated Mar 2, 2023

ivopetiz / network-scanner

TCP Network Port Scanner written in Go, nmap style.

• Updated Mar 7, 2020

MaamounBenhafsa / ip-ranger-scaner

scan a range of IP with a user input the start and the end of the IP range with a port to scan if open

• Updated Dec 13, 2019

wcoder / IP-Scanner

Simple IP subset scanner on .NET. Available for Windows, Linux and macOS.

• Updated Apr 12, 2023

RedSecurity / swit-scanner

Very Powerful and Easy Automated Web Scanner

• Updated Feb 2, 2021

Niamorro / Netleaf

Network Scanning Tool

• Updated Jul 15, 2024

namteckor / subnet-scanner

Bash script to automate initial host discovery and port scanning using a combination of fping, nping, nmap and rustscan

• Updated Jan 11, 2023

AppsInception / Network-Analyzer

Network Analyzer is an advanced network tools for wifi analyzer, network scanner, wifi scanner, wifi speed test, lan scanner, internet speed test and port scanner to troubleshoot and improve network issues

• Updated Jul 14, 2024

DevoTalk / fast-cf-ip-scanner

Fast Cloudflare IP Scanner

• Updated Jul 24, 2024

Improve this page

Add a description, image, and links to the ip-scanner topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the ip-scanner topic, visit your repo's landing page and select "manage topics."

Ransomware gang targets IT workers with new RAT masquerading as IP scanner

Ransomware-as-a-service outfit Hunters International is wielding a new remote access trojan (RAT). “The malware, named SharpRhino due to its use of the C# programming language, is delivered through a typosquatting domain impersonating the legitimate tool Angry IP Scanner,” Quorum Cyber researchers discovered.

Angry IP Scanner is an IP address and port scanner, and as such is more likely to be downloaded and used by IT workers. Such specific targeting might be an attempt to compromise systems and accounts that have higher privileges and access to most nooks and crannies of enterprise networks, so that the threat actor may swifly do much damage.

How the targets end up on the typosquatted domain is unknown, but malvertising seems like the most likely theory.

Earlier this year , a malvertising campaign similarly targeted IT pros via Google ads for system utilities, and delivered the Nitrogen malware.

The SharpRhino RAT

The name of the malicious file containing the RAT – ipscan-3.9.1-setup.exe – makes it look like a legitimate installer for the software it strives to impersonate (colloquially called ipscan).

The contents of the malicious installer (Source: Quorum Cyber)

The file is a NSIS installer, which modifies a Windows registry for persistence and creates a shortcut to Microsoft.AnyKey.exe , which then executes the LogUpdate.bat file.

That file contains a PowerShell script that compiles C# code and loads the compiled binary into memory and functions within it are ready to be called.

The malware also establishes two directories with identical files, enabling attackers to send commands to the RAT even if one of the directories is found and deleted.

About Hunters International

“So far, Hunters International has claimed responsibility for 134 attacks in the first seven months of 2024. Typical of ransomware operators, Hunters International exfiltrates data from victim organisations prior to encrypting files, changing file extensions to .locked , and leaving a README message guiding recipients to a chat portal on the TOR network for payment instructions,” the researchers noted .

Its targets are mostly organizations located in the Americas, Europe and Australia. The group avoids organizations based within the Russian influenced Commonwealth of Independent States (CIS), which points to the group having affiliate ties to Russia.

• Quorum Cyber
• remote access trojan

Featured news

• NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise?
• “Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days
• SSHamble: Open-source security testing of SSH services
• eBook: Cloud security skills
• Download: The Ultimate Guide to the CISSP
• eBook: Do you have what it takes to lead in cybersecurity?
• Microsoft 365 anti-phishing alert “erased” with one simple trick
• Traceeshark: Open-source plugin for Wireshark

Ransomware gang targets IT workers with new SharpRhino malware

Bill toulas.

• August 5, 2024

The Hunters International ransomware group is targeting IT workers with a new C# remote access trojan (RAT) called SharpRhino to breach corporate networks.

The malware helps Hunters International achieve initial infection, elevate their privileges on compromised systems, execute PowerShell commands, and eventually deploy the ransomware payload.

Quorum Cyber researchers who observed the malware  used in a ransomware attack report that it is disseminated by a typosquatting site impersonating the website for Angry IP Scanner, a legitimate networking tool used by IT professionals.

In January 2024, cybersecurity firm  eSentire  and researcher 0xBurgers previously saw the malware distributed through a fake Advanced IP Scanner website.

Hunters International is a ransomware operation launched in late 2023 and flagged as a possible rebrand of Hive due to its code similarities.

Notable victims include U.S. Navy contractor Austal USA , Japanese optics giant Hoya , Integris Health , and the Fred Hutch Cancer Center , where the cybercriminals demonstrated their lack of moral boundaries.

So far, in 2024, the threat group has announced 134 ransomware attacks against various organizations worldwide (except for CIS), ranking it tenth among the most active groups in the space.

SharpRhino RAT

SharpRhino spreads as a digitally signed 32-bit installer ('ipscan-3.9.1-setup.exe') containing a self-extracting password-protected 7z archive with additional files to perform the infection.

The installer modifies the Windows registry for persistence and creates a shortcut to Microsoft.AnyKey.exe, normally a Microsoft Visual Studio binary that is abused in this case.

Additionally, the installer drops 'LogUpdate.bat', which executes PowerShell scripts on the device to compile C# into memory for stealthy malware execution.

For redundancy, the installer creates two directories, 'C:\ProgramData\Microsoft: WindowsUpdater24' and 'LogUpdateWindows,' which are both used in the command and control (C2) exchange.

Two commands are hardcoded onto the malware, namely 'delay,' to set the timer of the next POST request for retrieving a command, and 'exit,' to terminate its communication.

Analysis shows that the malware can execute PowerShell on the host, which can be used to perform various dangerous actions.

Quorum tested this mechanism by successfully launching the Windows calculator through SharpRhino.

Hunters International's new tactic of deploying websites to impersonate legitimate open-source network scanning tools indicates that they are targeting IT workers in the hopes of breaching accounts with elevated privileges.

Users should be careful of sponsored results in search results to evade malvertising, activate ad blockers to hide these results entirely, and bookmark official project sites known to procure safe installers.

To mitigate the effects of ransomware attacks, establish a backup plan, perform network segmentation, and ensure all software is up to date to reduce opportunities for privilege elevation and lateral movement.

Update 8/6/24: Updated story to indicate the malware was previously seen by other researchers.

Related Articles:

Black Basta ransomware switches to more evasive custom malware

New LianSpy malware hides by blocking Android security feature

FBI: BlackSuit ransomware behind over $500 million in ransom demands

SEC ends probe into MOVEit attacks impacting 95 million people

CDK Global says all dealers will be back online by Thursday

• Hunters International
• Typo Squatting
• Previous Article
• Next Article

clememp - 3 days ago

Thanks for publishing this article.

Thomas_i90 - 1 day ago

Very interesting! Thank you!!

Post a Comment Community Rules

You need to login in order to post a comment.

Not a member yet? Register Now

You may also like:

Windows Update downgrade attack "unpatches" fully-updated systems

Microsoft 365 anti-phishing feature can be bypassed with CSS

Malwarebytes Anti-Malware

BitDefender Uninstall Tool

Help us understand the problem. What is going on with this comment?

• Abusive or Harmful
• Inappropriate content
• Strong language

Read our posting guidelinese to learn what content is prohibited.

You are using an outdated browser. Please upgrade your browser to improve your experience.

Sponsored Content

How to scan & sign documents with Scanner for iPhone

Scanner for iPhone

Last updated 1 day ago

Scanner for iPhone works as a single location to scan, annotate, sign, edit, and export documents. Unlike Apple's implementation, which is spread out and hidden behind menus, Scanner brings all the features to the forefront.

If you're running your business or managing personal documents with your iPhone, a document scanner is critical to your workflow. Scanning a document, applying a useful filter, and signing it are all needed to produce a useful digital document.

Scanner for iPhone gets everything done in one app. After scanning a document, it can be saved as a PDF or image.

When scanning documents, automatic edge detection previews what is about to be captured. Multiple pages can be captured, and filters can be applied before saving the document.

Scanner for iPhone also offers optical character recognition (OCR) and handwriting recognition. Documents can be synced across cloud systems like iCloud and Dropbox, and you can sign documents directly within the app, simplifying the e-signing process.

The quick and easy software offered by Scanner for iPhone ensures your digital document work is completed in a timely and safe manner. Not only are your documents easy to find in one place, they are more secure on your iPhone and more easily located and shared.

Users that manage a lot of documents might find themselves inundated with paperwork that is difficult to sort and find again later. Cut down on real-world clutter and sensitive information being easily found about your physical space by scanning essential documents into Scanner for iPhone then discarding the physical ones.

How to scan a document with Scanner for iPhone

• Open the Scanner for iPhone app.
• Tap the "Scan Document" button.
• Select if you'd like to scan a physical document or add it from the photo library or Files app.
• Align the iPhone camera with the document so the edge detection finds all the edges of the document.
• After scanning all the needed pages, tap the preview in the bottom right corner.
• Select the filter, adjust the crop, and rotate the documents as needed.
• Tap "Save" in the top right corner.

Get the Scanner for iPhone app from Apple's App Store. It offers a 3-day trial for the weekly $5.99 subscription, a one-month subscription for $9.99, and a 12-month subscription for $39.99.

Top Stories

Best price hits Apple's M3 MacBook Pro 14-inch, now $1,499

M4 Mac mini rumored to get a redesign making it smaller than ever before

When will Apple launch the iPhone 16 and iPhone 16 Pro?

iPhone 16 mass production begins, on time for mid-September launch

iPad Air OLED upgrade rumored to arrive in 2026, not 2028

Rumor Roundup: What the 2025 iPhone 17 family may bring to the table

Featured deals.

Apple's 1TB iPad Pro 13-inch dips to new record low price at $200 off

Latest news.

What's new in Quick Look for visionOS 2

Apple announced some new Quick Look features for visionOS 2.0 at WWDC 2024. In this article we'll look at new ways to use QuickLook in Apple Vision Pro.

Torras Ostand MagSafe Power Bank review: 2-in-1 charging and stand convenience

Torras' new MagSafe power banks are elegant and easy to use, keeping your devices fully charged on the go.

A critical security issue in 1Password for Mac left credentials vulnerable to attack

1Password has disclosed a now patched critical security flaw in its software that could give attackers access to users' unlock keys and credentials. Here's what to do to keep your data safe.

Epic Games & Spotify unsurprisingly unhappy with Apple's latest DMA update

Epic CEO Tim Sweeney was quick to criticize Apple's new fee structure in the EU, calling them "junk fees," while Spotify said the update is "unacceptable."

Amazon slashes Apple's iPad 9th Gen to $229, save up to $600 on entire range

Amazon is crushing it with back-to-school deals on a variety of iPad models, dropping prices to as low as $229.

Apple bows to EU pressure over App Store anti-steering practices

Apple has revised its App Store fees and requirements for developers in Europe, following pressure from the EU.

Recent reports have suggested that one of the M4 Macs will get a redesign soon, and a new rumor has identified which model will get it — the Mac mini.

Lexar Professional Go Portable SSD with Hub cuts iPhone videography cables

Lexar's Professional Go Portable SSD with Hub could be an iPhone filmmaker's dream, offering the benefits of externally recorded footage in a very compact package.

A new supply chain report says that iPhone 16 production began in June, but since then has ramped up in sufficient numbers to bode well for availability in mid-September.

Latest Videos

Distraction Control, Photos & more — hands on with all the changes in iOS 18 beta 5

Safari's Distraction Control will obliterate annoying website elements

Hands on: Siri starts to get better thanks to Apple Intelligence

Latest reviews.

Midea 2 Zone Air Fryer review: great air fryer, abysmal app, and lots of sticker shock

Tribit StormBox Speaker review: Simple, yet solid summer speaker

{{ title }}

{{ summary }}

Related Topics

• Application Security
• Cybersecurity Careers
• Cloud Security
• Cyberattacks & Data Breaches
• Cybersecurity Analytics
• Cybersecurity Operations
• Data Privacy
• Endpoint Security
• ICS/OT Security
• Identity & Access Mgmt Security
• Insider Threats
• Mobile Security
• Physical Security
• Remote Workforce
• Threat Intelligence
• Vulnerabilities & Threats
• Middle East & Africa
• Upcoming Events
• Newsletters
• Whitepapers
• Partner Perspectives:
• > Microsoft

Hunters International Disguises SharpRhino RAT as Legitimate Network Admin Tool Hunters International Disguises SharpRhino RAT as Legitimate Network Admin Tool

The RaaS group that distributes Hive ransomware delivers new malware impersonating as validly signed network-administration software to gain initial access and persistence on targeted networks

August 6, 2024

An emerging threat group that's made a meteoric rise to the top of the ransomware food chain has a new tool in its arsenal with a novel remote access Trojan (RAT). The group is using the tool in attacks that appear to be targeting IT professionals.

Researchers from Quorum Cyber revealed in a recent blog post that Hunters International, active since last October, is deploying Hive ransomware . The group uses the new malware, dubbed SharpRhino, first to gain access to targeted infrastructure and then to establish persistence and allow attackers to maintain remote access to the device.

SharpRhino compromises systems disguised as the open source network-administration tool Angry IP Scanner through typosquatting domains. Because Angry IP Scanner is open source, attackers can abuse and misuse valid code-signing certificates to make it look like a network admin is downloading software that has a valid certificate but instead is installing the malware, according to the post.

Upon execution, SharpRhino establishes persistence and provides the attackers with remote access to the device, which they then use to launch a typical ransomware attack using Hive ransomware. Hunters International acquired the malware from its original owners, a group that disbanded after it was taken out by international law enforcement soon after its inception.

"Using previously unseen techniques, the malware is able to obtain a high level of permission on the device in order to ensure the attacker is able to further their targeting with minimal disruption," Quorum Cyber threat intelligence analyst Michael Forret wrote in the post.

Evolution of a Ransomware Group

SharpRhino demonstrates the progression of Hunters International, a group linked to Russia. In the first seven months of 2024, the group claimed responsibility for 134 attacks. It has quickly risen to ascendance as the 10th most active ransomware group in 2024 thanks to its possession of Hive.

Leveraging the ransomware, the group has positioned itself as a ransomware-as-a-service (RaaS) provider that works with less sophisticated actors to do much of its dirty work, allowing it to spread Hive more quickly. "Being a RaaS provider is highly likely a main cause for their fast rise to notoriety," Forret wrote.

Like many other ransomware operators , Hunters International exfiltrates data from victim organizations prior to encrypting files, then changes file extensions to .locked and leaves a README message guiding recipients to a chat portal on the Tor network for payment instructions.

"The encryptor itself exhibits a sophisticated design, coded in Rust, a programming language increasingly favoured by cybercriminals for its security features, efficiency, and resistance to reverse engineering," Forret wrote. "This tactic is in line with the evolution observed in the ransomware development, with notable examples including both Hive and BlackCat."

Disguised as Legitimate Software

The researchers analyzed a sample of SharpRhino that used a valid certificate signed by the J-Golden Strive Trading Co. Ltd. The file that delivered the malware was a Nullsoft Scriptable Installer System (NSIS)-packed executable, a common file that most compression tools like 7-Zip can understand and read, Forret observed.

The installer system establishes persistence by modifying the Run\UpdateWindowsKey registry with the shortcut for Microsoft.AnyKey, and establishes two directories on the C:\ProgramData\Microsoft — called WindowsUpdater24 and another called LogUpdateWindows — to facilitate multiple channels to Hunters International's command and control (C2) as "a fallback mechanism," Forret noted.

"If the folder WindowsUpdater24 and its contents are discovered by a security engine or professional, there exists the possibility that the persistence mechanism will remain, and the device will remain infected,” he wrote.

Ultimately, SharpRhino's purpose in an attack is to give Hunters International persistence and control over a targeted system to "launch a sophisticated ransomware attack" for financial gain, which the group does without prioritizing any sector or region but instead by targeting "via opportunistic means," Forret wrote.

Qurom Cyber included a list of indicators of compromise for SharpRhino so organizations can identify if network administrators accidentally downloaded the RAT instead of the legitimate tool they believed to be deploying. It also provided Mitre ATT&CK Mapping for the RAT's defense and evasion, discovery, privilege escalation, execution, persistence, and C2 processes.

About the Author

Elizabeth Montalbano, Contributing Writer

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

You May Also Like

CISO Perspectives: How to make AI an Accelerator, Not a Blocker

Securing Your Cloud Assets

Black Hat Europe - December 9-12 - Learn More

SecTor - Canada's IT Security Conference Oct 22-24 - Learn More

Editor's Choice

Managing Third-Party Risk Through Situational Awareness

2024 InformationWeek US IT Salary Report

Forrester Total Economic Impact Study: Team Cymru Pure Signal Recon

SANS 2021 Cloud Security Survey

Forrester Report: The Total Economic Impact Of Bizagi's Low-Code Intelligent Process Automation Platform

How to Use Threat Intelligence to Mitigate Third-Party Risk

Boston Beer Company Transforms OT Security & Reduces Costs

OT Cybersecurity Glossary & Quick Start Guide

Leveling Up Cyber-Threat Intelligence Maturity for More Value and Better Insights