Malware

Nanocore RAT

Also known as: Nancrat · NanoCore

Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.

Indicators of Compromise 7

Domain 6789x[.]site Domain cel-robox[.]com Domain healthymagination[.]com Domain krogeralbertsons[.]com Domain maxfactor-international[.]com Domain rezilion[.]com Domain snsystems[.]com

MITRE ATT&CK TTPs 9

Ingress Tool Transfer

Command And Control

T1190

Exploit Public-Facing Application

Lateral Tool Transfer

Lateral Movement

T1583

Acquire Infrastructure

Resource Development

T1584

Compromise Infrastructure

Source Articles

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actor Sable Squirrel has spent nearly $7 million acquiring expired domains to exploit their inherited reputation, traffic, and backlinks for illegal sports streaming, online gambling promotion, and malware distribution. The group operates a dual-purpose infrastructure where re-registered domains serve both as streaming platforms and command-and-control (C2) servers for malware such as Quasar RAT and HiddenTear ransomware. The operation targets users in Asia and Australia through social media and ad networks, using a traffic distribution system to redirect victims while evading detection. Additional scavenger actors like Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel are also abusing expired domains for ad fraud, tech support scams, and traffic resale.

hacker-news ·2d ago