Three Chinese state-backed threat groups, APT10, GALLIUM, and Stately Taurus, have repeatedly employed a modified version of the open-source network scanning tool NBTscan over the past decade.  NBTscan, designed for network discovery and forensics, sends NetBIOS status queries to IP addresses within a specified range.  By analyzing the responses, it extracts valuable information like IP addresses, computer names, logged-in usernames, and MAC addresses, as these threat groups have leveraged NBTscan’s capabilities to gather intelligence on target networks and compromise systems. APT10, a Chinese threat group, has been identified as using a modified NBTscan tool to conduct reconnaissance against multiple targets.

Source: GBHackers