NanoCore

Essential information

Confidence: 100/100
Is family: Yes
Published: 29/01/2019 21:05
Modified: 27/03/2026 01:06
Revoked: No
Author / Source: The MITRE Corporation
Related entities: 29 attack patterns (mitre), 5 intrusion sets (apt), 1 countries, 8 indicators, 1 vulnerabilities (cve)

Description

[NanoCore](https://attack.mitre.org/software/S0336) is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.(Citation: DigiTrust NanoCore Jan 2017)(Citation: Cofense NanoCore Mar 2018)(Citation: PaloAlto NanoCore Feb 2016)(Citation: Unit 42 Gorgon Group Aug 2018)

Marking (TLP)

External references

Related entities

Gorgon Group uses

The MITRE Corporation Confidence 100

[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of…

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT28 uses IRON TWILIGHTSNAKEMACKEREL

The MITRE Corporation Confidence 100

[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub…

First seen 01/01/1970 · Last seen 16/11/5138 ·
APT33 uses HOLMIUMElfin

The MITRE Corporation Confidence 100

[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
SilverTerrier uses

The MITRE Corporation Confidence 100

[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Group5 uses

The MITRE Corporation Confidence 100

[Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing…

First seen 01/01/1970 · Last seen 16/11/5138 ·

Essential information

Description

Marking (TLP)

External references

Related entities

Attack patterns (MITRE) (29)

Intrusion sets (APT) (5)

Countries (1)

Indicators (8)

Vulnerabilities (CVE) (1)