Nanocore, Netwire and AsyncRAT spreading campaign uses public cloud infrastructure
Summary: Cisco Talos reported a campaign starting around Oct. 26, 2021 that delivered Nanocore, Netwire and AsyncRAT remote access trojans through phishing emails with ZIP attachments containing ISO images and obfuscated JavaScript, batch or VBScript downloaders. The download servers ran on Microsoft Azure Windows instances and an AWS EC2 instance, with command-and-control reached through free DuckDNS subdomains such as mback5338[.]duckdns[.]org on TCP port 7632 and asyncmoney[.]duckdns[.]org on TCP port 7829.
What's compelling: The actor rented cloud capacity instead of owning infrastructure, so the download servers and C2 addresses can be swapped quickly - and Cisco Umbrella saw requests to these malicious subdomains primarily from the United States, Canada, Italy and Singapore, meaning your outbound traffic to Azure and AWS is the place this shows up.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026