Responder
MITRE ATT&CK: S0174 View on attack.mitre.org
Aliases: SpiderLabs Responder, Responder
- Malware type
- credential-stealer
- Family
- Malware family
- Related IoCs
- 274 (4 malicious)
- Last IoC activity
- 2026-10-18 03:20:43
- Profile updated
- 2026-07-07 14:29:19
Context
Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Recent IoC activity
4 malicious indicators in Maltiverse are attributed to Responder (S0174). The 4 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| IP address | 143.198.112.191 | 2026-10-18 | 4 |
| IP address | 167.172.44.218 | 2026-10-16 | 8 |
| IP address | 172.86.76.246 | 2026-10-09 | 4 |
| IP address | 86.105.18.111 | 2026-09-25 | 5 |
Detection coverage
- 19 Sigma rules
Malware & tools used
- Network Sniffing (attack-pattern)
- Name Resolution Poisoning and SMB Relay (attack-pattern)
Used by threat actors
- Operation Dream Job (campaign)
- Ember Bear (threat-actor)
- Lazarus Group (threat-actor)
- APT28 (threat-actor)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Py.Responder (report)
- github.com — Responder (report)
- yoroi.company — Shadows From The Past Threaten Italian Enterprises (report)
- MITRE ATT&CK — S0174 (report)
- github.com — Responder (report)