H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

NICECURL

[NICECURL](https://attack.mitre.org/software/S1192) is a VBScript-based backdoor used by [APT42](https://attack.mitre.org/groups/G1044) to download additional modules.(Citation: Mandiant APT42-untangling)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[NICECURL](https://attack.mitre.org/software/S1192) is a VBScript-based backdoor used by [APT42](https://attack.mitre.org/groups/G1044) to download additional modules.(Citation: Mandiant APT42-untangling)

Labels

malware
6 recorded

Relationships

uses
from APT42
Group
uses
to Asymmetric Cryptography
Technique
uses
to Command and Scripting Interpreter
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Web Protocols
Technique
2 external

References

mitre-attack
S1192
open
Mandiant APT42-untangling
https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance