Log in Request a demo

Malware profile

NICECURL

NICECURL is a backdoor written in VBScript.

In short

NICECURL is a backdoor written in VBScript. MITRE ATT&CK lists APT42 as the user and says it downloads additional modules. MITRE says it gives the operator an interface to run commands, talks to its server over HTTPS and can remove its own artifacts.

Last updated 10 October 2026

Profile MapMalware
  1. Names1names in public reportsNICECURL
  2. Techniques5ATT&CK techniques listedExecution · Command and Control · Stealth
  3. Linked Groups1groups that use itAPT42

In one minute

What it is
A VBScript backdoor for Windows that downloads additional modules, per MITRE ATT&CK.
What it does
Gives the operator a way to run arbitrary commands, downloads more content (for example with curl), talks to its server over HTTPS and can remove its own artifacts.
Who uses it
MITRE lists APT42, which it describes as an Iranian-sponsored threat group, as the user. The Israel National Digital Agency refers to known NICECURL activity linked to APT42.
How it gets in
No source read for this page says how NICECURL reaches a machine. MITRE says APT42 starts operations with spear phishing emails or the PINEFLOWER Android malware.
What to do first
Watch for script interpreters that start curl and write files to the temp folder, and filter outbound HTTPS to approved destinations where you can.

What it does

NICECURL is a script-based backdoor. MITRE describes it as a way for APT42 to run commands on a machine and pull in further modules.

The Israel National Digital Agency compares a download, rename and run sequence seen in the SpearSpecter campaign with known NICECURL activity, in which the operator rebuilds the real curl command at run time and then runs it.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
NICECURLName of MITRE ATT&CK software S1192 and used in the Israel National Digital Agency SpearSpecter report[1, 2]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Execution

  • Command and Scripting Interpreter T1059

    It gives the operator an interface to run arbitrary commands.[1]

Command and Control

  • Ingress Tool Transfer T1105

    It can download extra content onto an infected machine, for example by using curl.[1]

  • Application Layer Protocol: Web Protocols T1071.001

    It has used HTTPS for command and control.[1]

  • Encrypted Channel: Asymmetric Cryptography T1573.002

    It has used HTTPS for command and control, which MITRE files under asymmetric cryptography.[1]

Stealth

  • Indicator Removal: File Deletion T1070.004

    It has a function to remove its own artifacts.[1]

How it spreads

No source read for this page says how NICECURL reaches a machine. MITRE says APT42 starts operations with spear phishing emails or the PINEFLOWER Android malware, and then monitors and collects information from the compromised systems.

Timeline

  1. November 2025

    Israel National Digital Agency compares SpearSpecter with NICECURL

    The agency's report on a campaign it ties to the IRGC Intelligence Organization says the campaign's download, rename and run sequence matches known NICECURL activity linked to APT42.[2]

Detection and defense

  1. Filter outbound traffic

    MITRE advises network filtering that blocks outbound traffic from compromised systems to unapproved external destinations, and restricting outbound HTTP and HTTPS from critical servers.[4, 5]

    Counters: T1105 T1071.001

  2. Use network signatures and TLS inspection

    MITRE advises network intrusion prevention with signatures for known malware, and SSL/TLS inspection to look for network indicators in encrypted sessions.[5, 6]

    Counters: T1573.002 T1071.001

  3. Control command and scripting interpreters

    MITRE advises application control, only running signed scripts where possible, and attack surface reduction rules against Visual Basic scripts that run downloaded content.[7]

    Counters: T1059

  4. Follow the agency's guidance for the campaign

    The Israel National Digital Agency advises PowerShell logging, application control, a filtering proxy and training of senior staff against the APT42 campaign it describes.[2]

  5. Know what is not published

    No government advisory with NICECURL detection signatures or indicators was found. Use MITRE S1192 and the Israel National Digital Agency report as the official references.[1, 2]

Questions

What is NICECURL?

MITRE ATT&CK describes NICECURL as a VBScript-based backdoor that APT42 used to download additional modules.

Who uses NICECURL?

MITRE lists APT42, an Iranian-sponsored group that conducts cyber espionage and surveillance and has been active since at least 2015.

What can NICECURL do?

MITRE says it provides an interface to run arbitrary commands, can download more content, for example with curl, uses HTTPS for command traffic and has a function to remove artifacts.

How does NICECURL reach a machine?

No source read for this page says. MITRE says APT42 starts operations with spear phishing emails or the PINEFLOWER Android malware.

Is NICECURL related to TAMECAT?

MITRE lists both as APT42 malware. The Israel National Digital Agency compares a command sequence in the SpearSpecter campaign, which used TAMECAT, with known NICECURL activity.

In our research

  1. APT42 Threat group

Sources

  1. NICECURL, Software S1192 MITRE ATT&CKSupports: Description, platform, techniques with use sentences, APT42 as the listed group
  2. SpearSpecter: Unmasking Iran's IRGC Cyber Operations Targeting High-Profile Individuals Israel National Digital AgencySupports: November 2025 report, comparison with known NICECURL activity linked to APT42
  3. APT42, Group G1044 MITRE ATT&CKSupports: APT42 described as Iranian-sponsored, active since at least 2015, starts with spearphishing or PINEFLOWER
  4. Ingress Tool Transfer, T1105 MITRE ATT&CKSupports: Mitigations M1037 and M1031
  5. Application Layer Protocol: Web Protocols, T1071.001 MITRE ATT&CKSupports: Mitigations M1037 and M1031
  6. Encrypted Channel: Asymmetric Cryptography, T1573.002 MITRE ATT&CKSupports: Mitigations M1031 and M1020
  7. Command and Scripting Interpreter, T1059 MITRE ATT&CKSupports: Mitigations for command and scripting interpreters

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Backdoor

A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Command and Scripting Interpreter

Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.

Read more

Technique

Ingress Tool Transfer

Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into.

Read more