MALWARE FAMILY

Nanocore RAT

Internal ID: win.nanocore

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.

Threat Analysis

Nanocore RAT is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://0xmrmagnezi.github.io/malware%20analysis/NanoCore/

→https://assets.virustotal.com/reports/2021trends.pdf

→https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/

→https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/

→https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/

→https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack

→https://blog.morphisec.com/syk-crypter-discord

→https://blog.talosintelligence.com/2020/02/coronavirus-themed-malware.html

→https://blog.talosintelligence.com/2020/12/2020-year-in-malware.html

→https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.nanocore

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Nanocore RAT