Synful Knock Scanner

Talos has developed a Python script for customers to scan their own network to identify routers that may have been compromised by this specific malware. The script works by scanning networks, looking for devices answering to the SYNful Knock malware. This tool can only detect hosts responding to the malware "knock" as it is known at a particular point in time. It can be used to help detect and triage known compromises of infrastructure. Upon successful detection of the “knock” on your network, the Synful Knock Scanner will provide further instructions so that we may assist you.