Network Service Discovery (T1046): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1046.
- Tactical Phase: Discovery.
- Substantiated in 2 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (2)
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
"Seleznev conducted port scans across internet subnets searching for open and vulnerable Remote Desktop Protocol (RDP) port 3389."
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
WannaCry spawned threads scanning random public IP addresses and local RFC 1918 subnets on TCP port 445 to propagate autonomously.
Commonly Charged Criminal Statutes
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
Wire Fraud
Prohibits devising a scheme or artifice to defraud or obtain money or property by means of false or fraudulent pretenses, representations, or promises via wire communications.
Conspiracy to Commit Wire Fraud
Applies the same penalties as the underlying substantive wire fraud offense to any person who attempts or conspires to commit wire fraud.
Aggravated Identity Theft
Mandates a consecutive two-year prison sentence for knowingly transferring, possessing, or using without lawful authority a means of identification of another person during felony computer fraud or wire fraud.