{
  "family": "fspm",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nFspm is a classification typically applied to a HackTool or localized exploit script designed to bypass security controls or facilitate unauthorized access, often specifically targeting misconfigurations or vulnerabilities in file sharing protocols or specific enterprise software suites. The presence of an Fspm tool indicates a targeted attempt by an attacker (or an unauthorized insider) to map, exploit, or extract data from network resources.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFspm tools are generally not self-spreading malware. They are explicitly downloaded and executed by an attacker who has already gained initial access to a network (e.g., via a compromised VPN or RDP session) and is attempting to move laterally or locate sensitive data.\n\nCapabilities vary based on the specific variant, but generally focus on network exploitation:\n<ul>\n<li><strong>Protocol Scanning and Exploitation:</strong> The tool may rapidly scan the local subnet for specific open ports (like SMB/445 or FTP/21) and attempt to exploit known vulnerabilities or misconfigurations (such as anonymous access or weak default credentials).</li>\n<li><strong>Share Enumeration:</strong> Fspm tools often automate the process of mapping hidden or administrative network shares (e.g., `C$`, `ADMIN$`), allowing the attacker to locate file servers, backup repositories, or user directories that should be restricted.</li>\n<li><strong>Brute-Forcing:</strong> Some variants include localized brute-forcing capabilities, attempting a rapid dictionary attack against identified services using a hardcoded list of common corporate passwords.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an Fspm tool is a critical security event indicating active, post-compromise lateral movement and reconnaissance. The attacker is actively mapping the internal network topology and attempting to identify targets for data exfiltration or ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Endpoint Isolation:</strong> The endpoint where the Fspm tool was executed must be isolated from the network immediately to halt the active reconnaissance and prevent further lateral movement.</li>\n<li><strong>Hunt for Lateral Movement (Network Logs):</strong> Security analysts must review internal firewall logs, Windows Event Logs (specifically Event ID 4624 - Successful Logon), and EDR telemetry to trace the network connections initiated by the tool. Identify any internal servers or shares the attacker successfully accessed.</li>\n<li><strong>Re-imaging and Credential Audit:</strong> The compromised machine must be wiped and re-imaged from a known-good baseline. A comprehensive audit of network share permissions and service account credentials is required to remediate the vulnerabilities the tool was attempting to exploit.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.Fspm",
    "Exploit.Win32.Fspm",
    "Tool.NetworkScanner"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1046",
    "T1135",
    "T1110.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:36:34Z",
  "type": "HackTool / Exploit",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}