NanoCore
MITRE ATT&CK: S0336 View on attack.mitre.org
Aliases: NanoCore
- First seen
- 2013-01-01 00:00:00
- Malware type
- rat, keylogger, screen-capture, spyware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 13489 (12274 malicious)
- Last IoC activity
- 2026-10-18 04:13:01
- Profile updated
- 2026-07-07 13:18:57
Targeted industries: education-and-nonprofits financial-services government-and-public-sector healthcare-and-pharmaceutical manufacturing retail-and-hospitality
Context
NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.
Recent IoC activity
12,281 malicious indicators in Maltiverse are attributed to NanoCore (S0336). The 20 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | blv23728.ddns.net | 2026-10-18 | 2 |
| hostname | nazareen12.ddns.net | 2026-10-18 | 2 |
| hostname | skysky.duckdns.org | 2026-10-18 | 3 |
| hostname | home.no-ip.net | 2026-10-18 | 1 |
| hostname | 419millions.chickenkiller.com | 2026-10-18 | 2 |
| hostname | stankovic.geekgalaxy.com | 2026-10-18 | 1 |
| hostname | shamim.zapto.org | 2026-10-18 | 1 |
| hostname | asweee.jumpingcrab.com | 2026-10-18 | 1 |
| hostname | strongodss.ddns.net | 2026-10-18 | 3 |
| hostname | record-synthesis.gl.at.ply.gg | 2026-10-18 | 1 |
| hostname | saka1.ddns.net | 2026-10-18 | 1 |
| hostname | strongods.ddns.net | 2026-10-18 | 4 |
| hostname | ichbin1337.ddns.net | 2026-10-18 | 1 |
| hostname | olodofries8.ddns.net | 2026-10-18 | 1 |
| hostname | mallow2.3utilities.com | 2026-10-18 | 1 |
| hostname | frank3000.ddns.net | 2026-10-18 | 2 |
| hostname | 21.ip.gl.ply.gg | 2026-10-18 | 1 |
| hostname | googleusercontent.ddns.net | 2026-10-18 | 1 |
| hostname | anderchuka.duckdns.org | 2026-10-18 | 2 |
| hostname | datalogsbackups.hopto.org | 2026-10-18 | 1 |
Detection coverage
- 1 YARA rules
- 497 Sigma rules
Malware & tools used
- Ingress Tool Transfer (attack-pattern)
- Windows Command Shell (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Video Capture (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Audio Capture (attack-pattern)
- Disable or Modify System Firewall (attack-pattern)
- Visual Basic (attack-pattern)
- Keylogging (attack-pattern)
- Modify Registry (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
Used by threat actors
- Gorgon Group (threat-actor)
- APT33 (threat-actor)
- Group5 (threat-actor)
- SilverTerrier (threat-actor)
Detection rules
- DITEKSHEN_MALWARE_Win_Nanocore (yara-rule)
Reports & references
- researchcenter.paloaltonetworks.com — Unit42 Gorgon Group Slithering Nation State Cybercrime (report)
- MITRE ATT&CK — S0336 (report)
- researchcenter.paloaltonetworks.com — Nanocorerat Behind An Increase In Tax Themed Phishing E Mails (report)
- web.archive.org — Nanocore Rat Resurfaced Sewers (report)
- digitrustgroup.com — Nanocore Not Your Average Rat (report)