NiceRAT Malware Targets South Korean Users via Cracked Software

The report details active campaigns targeting South Korean users that distribute NiceRAT—an open-source Python remote access trojan and stealer—often bundled with cracked software; NiceRAT uses Discord webhooks for command-and-control and is offered in free and premium (MaaS) forms, while related activity references NanoCore, Nitol/Amadey, and the Bondnet botnet leveraging FRP reverse proxies.