TCP 9002
Synopsis
- DynamID authentication service (IANA-registered service name “dynamid”) uses TCP port 9002.
- The “9002” backdoor/RAT (aka 9002 Trojan), used by threat actors such as Naikon/APT30, communicates with its command-and-control servers over TCP 9002; it’s explicitly associated with hacking/exploitation.
Observed activity
Last 30 days
Detailed chart