Nano CoreRAT Behind an Increase in Tax-Themed Phishing E-mails
Summary: Palo Alto Networks researchers identified 70 unique malware samples distributed across 2,062 email sessions between September 2, 2015 and January 28, 2016, in a tax-themed phishing campaign using subject lines with keywords like 'report', 'tax', 'secure' and 'pin'. The attachments were PE files or Microsoft Word documents with malicious macros, and the payloads consisted predominantly of NanoCoreRAT or a generic macro downloader that would download and execute NanoCoreRAT.
What's compelling: A fully cracked version of NanoCore 1.2.2.0 with premium plugins was released around March 2015, making a modular RAT with plugin-based capabilities available to less sophisticated adversaries, and the researchers observed its incorporation into tax-themed phishing since June 2015 with a continuing increase in activity.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026