{
  "family": "nanocore",
  "sample_count": 2400,
  "category": "rat",
  "description": "NanoCore is a modular remote access tool developed in .NET that, per MITRE ATT&CK, can be used to spy on victims and steal information, and has been used by threat actors since 2013. Marketed originally as a remote-administration product, it was widely abused; its author was prosecuted, but cracked builds continued to circulate. Its plugin architecture supports a broad range of surveillance and data-theft capabilities.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "NanoCore"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is NanoCore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A modular .NET remote access tool, used by threat actors since 2013, capable of spying on victims and stealing information."
      }
    },
    {
      "@type": "Question",
      "name": "Is NanoCore legitimate software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was marketed as remote-administration software but became widely abused as a RAT; its developer was prosecuted for facilitating malicious use."
      }
    },
    {
      "@type": "Question",
      "name": "What can NanoCore do once installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through its plugin system it can provide remote control, keylogging, credential theft, and surveillance such as webcam access."
      }
    },
    {
      "@type": "Question",
      "name": "How is NanoCore delivered?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Commonly through phishing emails carrying malicious attachments or downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "Why does NanoCore keep appearing despite the prosecution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cracked versions of the builder circulated publicly, so many different actors continue to deploy their own variants."
      }
    },
    {
      "@type": "Question",
      "name": "How do I reduce the risk of RATs like NanoCore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Be cautious with email attachments and downloads, keep endpoint protection updated, and avoid pirated software that often bundles such tools."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's NanoCore entry (S0336), linked on this page."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1496",
    "T1041",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "MITRE ATT&CK: NanoCore (S0336)",
      "url": "https://attack.mitre.org/software/S0336"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0336",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}