NICECURL

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[NICECURL](https://attack.mitre.org/software/S1192) is a VBScript-based backdoor used by [APT42](https://attack.mitre.org/groups/G1044) to download additional modules.(Citation: Mandiant APT42-untangling)

Associated Techniques (5)

ID	ATT&CK	Tactics
T1059	Command and Scripting Interpreter	-
T1070.004	File Deletion	-
T1071.001	Web Protocols	-
T1105	Ingress Tool Transfer	-
T1573.002	Asymmetric Cryptography	-

Used by Actors (1)

APT42
Nation-state

Metadata

ID:	22
Created:	13/01/2026 17:48
Updated:	23/04/2026 04:00