KScan

Reported Context (1)

Cluster 8 (Active since at least March 10, 2026), which deploys the KScan asset mapping tool and Nim-based backdoor that’s likely based on NimPlant and comes with capabilities to perform file operations, execute files CISA Adds Cisco SD-WAN Authentication Bypass to KEV After Active Exploitation

CVE (5)

Malware (4)

Threat Actors (1)

MITRE ATT&CK (8)

Vendors (1)

Products (1)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.