สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool HDoor

Threat Group Cards: A Threat Actor Encyclopedia

Tool: HDoor

Names	HDoor Custom HDoor
Category	Malware
Type	Reconnaissance, Backdoor, Info stealer, Wiper, Tunneling
Description	(Kaspersky) The Naikon APT frequently used a custom backdoor that appears to be an HDoor variant, based on old “Honker Union” code like “hscan v120”. For example, once on a victim network, one of the first steps is to run the hdoor -hbs scan to identify target local network hosts. The Naikon APT’s custom-built HDoor tool is a robust reconnaissance tool for lateral movement, supporting the identification of, interfacing with and attacking of multiple technologies and resources: • host, user, group, and related authentication resources and cracking/brute forcing capabilities • network asset scanning and identification, including SQL database, embedded network devices like home or SMB routers, and other common network services • fake service listener to sniff traffic • disk wiping – safe delete with multiple overwrites • process management • local filetime modifier • SQL administration toolset • SOCKS5 proxy service • banner-based scanner • AV killer
Information	<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf> <https://securelist.com/cycldek-bridging-the-air-gap/97157/>
MITRE ATT&CK	<https://attack.mitre.org/software/S0061/>

Last change to this tool card: 30 December 2022

Download this tool card in JSON format

Previous: hcdLoader
Next: HDRoot

All groups using tool HDoor

Changed	Name	Country	Observed
APT groups
	Goblin Panda, Cycldek, Conimes		2013-Jun 2020
	Naikon, Lotus Panda		2010-Apr 2022

2 groups listed (2 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]