ShapNBTScan (055e70b5-c279-41d4-ad11-c2a884929d88)
A NetBIOS scanner. Ghost actors use this tool for hostname and IP address enumeration.[U.S. CISA Ghost Cring Ransomware February 19 2025]
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Ghost Ransomware Actors (9dc09b70-b1c0-45d1-94a8-490943c69166) | Tidal Groups | ShapNBTScan (055e70b5-c279-41d4-ad11-c2a884929d88) | Tidal Software | 1 |