Nanocore - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/nanocore/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 13:38:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNanocore RAT: New Infrastructure and Payload Indicatorshttps://feed.craftedsignal.io/briefs/2026-11-nanocore-rat-indicators/Thu, 05 Nov 2026 13:38:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nanocore-rat-indicators/ThreatFox identified new Nanocore RAT payloads and C2 infrastructure, indicating active maintenance of distribution and communication channels.ThreatFox has reported eight new indicators of compromise related to the Nanocore remote access trojan (RAT), consisting of malicious payloads and command-and-control (C2) infrastructure. These indicators reflect ongoing activity involving Nanocore, a known commodity RAT that provides attackers with extensive remote control capabilities over compromised Windows systems.

Impact

The identified C2 infrastructure (a dynamic DNS domain and a hardcoded IP address) allows for the remote management of infected hosts. The associated file hashes represent active payloads used in current distribution efforts.

Recommendation

  • Block the identified C2 domain and IP address at your perimeter firewall and DNS resolvers.
  • Implement file integrity monitoring to detect the presence of the identified malicious hashes on endpoints.
  • Perform a threat hunt across EDR telemetry for connections to the identified C2 infrastructure.
]]>highadvisorynanocoreratmalwarec2