malware

NICECURL

S1192 · ATT&CK v19.2

Platforms

Windows

Tracked actors

Description

[NICECURL](https://attack.mitre.org/software/S1192) is a VBScript-based backdoor used by [APT42](https://attack.mitre.org/groups/G1044) to download additional modules.(Citation: Mandiant APT42-untangling)

Actors that use this

1 tracked actor

Charming Kitten / APT42ATT&CK-attributed