Botnet Installing NiceRAT Malware

**AhnLab reports that persistent botnets—primarily NanoCore—distributed via cracked software and file-sharing sites have been actively installing additional malware (notably NiceRAT and Nitol) since 2019.** The report documents NiceRAT behavior (anti-analysis, persistence, IP/location collection) and its use of a Discord webhook C2, lists observed C2 domains and URLs, provides file detections and sample MD5s, and warns that these long-lived botnets enable continued secondary malware distribution and data exfiltration.