Last seven days
- First activity
- Aug 26, 2026
- Last activity
- Sep 2, 2026
- Feed role
- C2 / Distribution
- Host form
- 21 IP / 368 hostnames
NanoCore
NanoCore RAT is a Windows-based remote access trojan used in criminal and intrusion activity to provide persistent remote control over compromised systems.
Profile source: Mallory opens in a new tabNanoCore
Family profile
NanoCore RAT is a Windows-based remote access trojan used in criminal and intrusion activity to provide persistent remote control over compromised systems. It is commonly categorized as a commodity .NET RAT and has been observed alongside other widely used families such as AsyncRAT, Quasar RAT, Remcos RAT, and njRAT. NanoCore has been used by both financially motivated operators and state-linked actors seeking to blend into ordinary cybercrime traffic through use of publicly available malware.
Documented NanoCore capabilities include keylogging, collection of victim network information such as the host IP address, modification of the Windows Registry, and encrypted command-and-control communications using DES. It has also been observed establishing persistence through VBScript-based mechanisms, including creation of Registry RunOnce autorun entries to execute VBS scripts at user logon. These behaviors are consistent with post-compromise surveillance and long-term remote access on victim endpoints.
NanoCore has been distributed through phishing and spearphishing campaigns, including coronavirus-themed email lures, and has also appeared as a payload delivered by malware distribution systems and loaders such as GuLoader. Reporting also links it to broader malware-delivery ecosystems that distribute multiple commodity RATs. Infrastructure associated with NanoCore has appeared in abuse of cloud tunneling services for command-and-control concealment, and NanoCore samples have been observed communicating with malicious infrastructure embedded in repurposed expired domains.
Use of NanoCore has been associated with Iranian activity, including reporting that APT33 and IRGC-linked operators used NanoCore as an off-the-shelf RAT in campaigns targeting sectors such as aerospace, satellite technology, and international organizations. More broadly, NanoCore-related infrastructure has been observed reaching victims across sectors including education, government, healthcare, banking, and information technology. Its continued presence in commodity malware ecosystems and mixed criminal-state usage makes it a durable and widely recognized RAT family.
Capabilities
- Keylogging
- Persistence
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
69 Aug 26
21 Aug 27
82 Aug 28
33 Aug 29
31 Aug 30
29 Aug 31
30 Sep 1
Observed infrastructure
Leading locations
- US264
- DE8
- NL8
- SE5
- SG3
- RU2
- FR1
- HK1
- KR1
- MD1
- PL1
Leading providers
- Cloudflare, Inc.249
- Amazon.com, Inc.5
- Amazon.com, Inc.5
- Bahnhof AB4
- Omegatech LTD4
- DEDIK SERVICES LIMITED3
Infrastructure traits
- Hosting 290
- Anycast 252
- Proxy 3
Samples
Recent associated samples
040fc9205dd81fea2d34a0020c4485a8cafc15b9b31016244f6cb4dbf768e311 Observed Sep 2, 2026Triage
2c303b28f3f1cdd45121273e0905bcfd3d03e78c242a168be33f538e611eb3ef Observed Sep 2, 2026Triage
3a8ebdbc7ade5de588bd1e6ab1b286af1da9524c53f0c41f7d26e7ac6fbebe62 Observed Sep 2, 2026Triage
b339391ea5029bff0a83bb4c86efce50d388056d138ba97ecf8b6da51c53e0c8 Observed Sep 2, 2026Triage
efdfd05a4f2b3cc05beca40603e375af74ae1dbe369da818d19206fcea00bb4f Observed Sep 2, 2026Triage
2c80b32e3f47c70ca0eaa53b169a8d7ff6fb13844a61e538ab0dda4374baa600 Observed Sep 2, 2026Triage
36057a4f44b9aa863c2694833ba2af76bd0f4d873079aec02bcd6d2d5a468009 Observed Sep 2, 2026Triage
5f10ffa5d0b24fb46bbb845f66ddce79b9c87d355de4282c49de4b8e8e456674 Observed Sep 2, 2026Triage
cd4089d3fb91f7873ee1883a7c453335246d3d50b0530c0043463c2e61e3d08c Observed Sep 2, 2026Triage
f16f603022a036e5fc4b86eafe368f66757ed353e87be66da58772a4ba7558b6 Observed Sep 2, 2026Triage
Reported operators
Threat actors
12 named in public reportingк доменам хак-группы обращались более 31 000 образцов вредоносов, включая Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT и njRAT
APT33 is known to use publicly available remote access trojans (RATs) like Nanocore to blend in with normal cybercriminal activity and avoid the attribution which typically comes from the implementation of custom malware.
In some cases, the final stage PowerShell script contained up to seven various RATs. These are typically NjRat, BitRat, Nanocore RAT, QuasarRat, LimeRat, and Warzone.
...the delivered payload is in favor of publicly sold malware such as NanoCore, Formbook, etc...
In addition to the nature of the backdoor virus, ReZer0 also carries known remote control Trojans such as NanoCore and Remcos in the resources.
According to the indictment, one of the main malware tools used in the attacks was the Nanocore RAT (Trojan.Nancrat). Although it was publicly available, Symantec has observed Elfin make extensive use of Nanocore.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
With an average of 125 unique samples per month, NanoCore was the most frequently seen RAT employed by SilverTerrier actors in 2018.
"The malware downloaded and executed by the .Net downloader is NanoCore, a well-known RAT (Remote Access Trojan) that enables the remote monitoring of victims via their computers."
Exploited software
Vulnerabilities linked to NanoCore
4 CVEsMITRE ATT&CK
NanoCore in ATT&CK
53 distinct techniquesTechniques
53 techniques T1071 Application Layer Protocol T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic T1105 Ingress Tool Transfer T1112 Modify Registry T1566 Phishing T1059.003 Windows Command Shell T1573 Encrypted Channel T1016 System Network Configuration Discovery T1059.007 JavaScript T1056.001 Keylogging T1136 Create Account T1056 Input Capture T1219 Remote Access Tools T1055 Process Injection T1204 User Execution T1566.002 Spearphishing Link T1095 Non-Application Layer Protocol T1123 Audio Capture T1566.001 Spearphishing Attachment T1125 Video Capture T1059.001 PowerShell T1204.002 Malicious File T1053.005 Scheduled Task T1620 Reflective Code Loading T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1082 System Information Discovery T1027 Obfuscated Files or Information T1497 Virtualization/Sandbox Evasion T1564.004 NTFS File Attributes T1568 Dynamic Resolution T1059 Command and Scripting Interpreter T1053 Scheduled Task/Job T1537 Transfer Data to Cloud Account T1203 Exploitation for Client Execution T1113 Screen Capture T1571 Non-Standard Port T1583.001 Domains T1562.001 Disable or Modify Tools T1074 Data Staged T1055.012 Process Hollowing T1070.004 File Deletion T1562 Impair Defenses T1037 Boot or Logon Initialization Scripts T1657 Financial Theft T1555 Credentials from Password Stores T1070 Indicator Removal T1573.001 Symmetric Cryptography T1562.004 Disable or Modify System Firewall T1036 Masquerading T1027.002 Software Packing T1189 Drive-by Compromise
Reporting
