{
  "family": "nanobot",
  "sample_count": 306,
  "category": "rat",
  "description": "Backdoor:Win32/Nanobot is a modular, highly customizable Remote Access Trojan (RAT) and botnet agent known for its small footprint, evasive network communications, and plugin-based architecture.<br><br><b>Understanding Nanobot</b><br>To a layman, Nanobot is a silent observer that grants a hacker total access to their files and webcam. For cybersecurity experts, Nanobot is a dangerous, flexible threat. Unlike monolithic RATs, Nanobot consists of a tiny core executable that establishes a secure connection to the C2 server. The attacker can then push down specific 'plugins' on demand—such as a keylogger module, a cryptominer, or a DDoS attack engine—minimizing the malware's footprint on the disk and evading static analysis.<br><br><b>Execution and Evasion Strategies</b><br>Nanobot is frequently deployed as a second-stage payload by initial access brokers or exploit kits. Upon execution, the core module injects itself into legitimate Windows processes (like <code>explorer.exe</code> or <code>svchost.exe</code>). It heavily utilizes encrypted communications, often communicating over port 443 (HTTPS) to blend in with normal web traffic. Threat hunters will rarely find the full suite of hacking tools on the disk; instead, they must analyze the memory of the injected process to find the dynamically loaded plugins.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of a Nanobot infection is total system compromise. The attacker can exfiltrate sensitive data, monitor the user in real-time, or pivot to attack other machines on the network. Incident responders should look for anomalous, persistent HTTPS connections originating from system processes to unknown IP addresses. Memory forensics is critical to extract the RC4 or AES decryption keys used by Nanobot to communicate with its C2 infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1125",
    "T1105",
    "T1055",
    "T1056.001",
    "T1573.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1573.001",
      "name": "Encrypted Channel: Symmetric Cryptography",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately sever the network connection; Nanobot provides the attacker with a live, interactive shell on the endpoint.",
    "Capture a full forensic memory image of the machine to extract the dynamically loaded plugins and the C2 encryption keys.",
    "Analyze firewall logs to identify the C2 IP address and block it across the enterprise perimeter.",
    "Rebuild the operating system from a known-good image, as Nanobot's deep process injection and modularity make it difficult to guarantee full eradication."
  ],
  "what_to_avoid": [
    "Do not leave the machine powered on and connected to the network; the attacker can quickly deploy a ransomware module if they detect an investigation.",
    "Avoid assuming a simple AV scan will remove the threat; the core module is often highly obfuscated and the plugins exist only in memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}