NanoCore
Software · ATTACK:enterprise:S0336
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0336",
"title": "NanoCore",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0336",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--b4d80f8b-d2b9-4448-8844-4bef777ed676",
"external_id": "S0336",
"domain": "enterprise",
"created": "2019-01-29T20:05:35.952Z",
"modified": "2024-09-25T15:05:04.341Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "NanoCore"
},
{
"source_name": "Unit 42 Gorgon Group Aug 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
},
{
"source_name": "PaloAlto NanoCore Feb 2016",
"url": "https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"
},
{
"source_name": "Cofense NanoCore Mar 2018",
"url": "https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/"
},
{
"source_name": "DigiTrust NanoCore Jan 2017",
"url": "https://www.digitrustgroup.com/nanocore-not-your-average-rat/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10806c6b-100d-456b-bb05-62d90713be64
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13219288-d8b3-4464-a173-923ed8dfae0a
PaloAlto NanoCore Feb 2016 · Cofense NanoCore Mar 2018ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14fe92e6-9a5e-4116-8316-e52f6270b02c
DigiTrust NanoCore Jan 2017ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1efc9685-b2ab-46fb-91a9-a305d6c1f335
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f884873-308c-4bee-94bd-90bb2267fea7
PaloAlto NanoCore Feb 2016ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57a7fefa-774b-4653-af2d-ebf3e2e315ce
FireEye APT33 Webinar Sept 2017ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cd2bb27-c043-455f-b67f-88ec4bbe2d93
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69205d34-6967-40df-baed-45b5d23d8e27
Unit42 SilverTerrier 2018ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dfdfcc8-ff89-4991-830a-5ca31f43b251
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72e501db-419e-4fe9-9f10-fa8f266d829b
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86b724dd-09f8-4182-adff-08ba6e391747
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a01519cd-b198-4c60-a5ed-1ca3528d0606
Cofense NanoCore Mar 2018ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a09b9e3f-96b8-4fde-9f7d-261b449cdabd
PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a21afd42-09ae-4e6b-a065-dc1b4454216d
DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5f33976-796d-46b8-9c5f-5545ef25c03f
PaloAlto NanoCore Feb 2016ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd417d31-d129-44ac-8a9f-b14b79235dfa
Cofense NanoCore Mar 2018ATTACK:enterprise:G0043 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8ddf5f6-ec20-4eb6-bd22-b02f54a99693
Citizen Lab Group5