H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[NanoCore](https://attack.mitre.org/software/S0336) is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.(Citation: DigiTrust NanoCore Jan 2017)(Citation: Cofense NanoCore Mar 2018)(Citation: PaloAlto NanoCore Feb 2016)(Citation: Unit 42 Gorgon Group Aug 2018)

Labels

malware

17 recorded

Relationships

uses

from APT33

Group

uses

from Gorgon Group

Group

uses

Group

uses

to Audio Capture

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Disable or Modify Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Video Capture

Technique

uses

to Visual Basic

Technique

uses

to Windows Command Shell

Technique

uses

from SilverTerrier

Group

6 external

References

mitre-attack

S0336

NanoCore

—

Unit 42 Gorgon Group Aug 2018

https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/

PaloAlto NanoCore Feb 2016

https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/

Cofense NanoCore Mar 2018

https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/

DigiTrust NanoCore Jan 2017

https://www.digitrustgroup.com/nanocore-not-your-average-rat/