{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/nanocore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["nanocore","rat","malware","c2"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThreatFox has reported eight new indicators of compromise related to the Nanocore remote access trojan (RAT), consisting of malicious payloads and command-and-control (C2) infrastructure. These indicators reflect ongoing activity involving Nanocore, a known commodity RAT that provides attackers with extensive remote control capabilities over compromised Windows systems.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe identified C2 infrastructure (a dynamic DNS domain and a hardcoded IP address) allows for the remote management of infected hosts. The associated file hashes represent active payloads used in current distribution efforts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock the identified C2 domain and IP address at your perimeter firewall and DNS resolvers.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring to detect the presence of the identified malicious hashes on endpoints.\u003c/li\u003e\n\u003cli\u003ePerform a threat hunt across EDR telemetry for connections to the identified C2 infrastructure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T13:38:42Z","date_published":"2026-11-05T13:38:42Z","id":"https://feed.craftedsignal.io/briefs/2026-11-nanocore-rat-indicators/","summary":"ThreatFox identified new Nanocore RAT payloads and C2 infrastructure, indicating active maintenance of distribution and communication channels.","title":"Nanocore RAT: New Infrastructure and Payload Indicators","url":"https://feed.craftedsignal.io/briefs/2026-11-nanocore-rat-indicators/"}],"language":"en","title":"CraftedSignal Threat Feed - Nanocore","version":"https://jsonfeed.org/version/1.1"}