Loading malware…
NanoSlate is an espionage backdoor identified by ESET and used by the China-aligned threat actor PerplexedGoblin, which overlaps with APT31. According to the provided reporting, ESET observed PerplexedGoblin/APT31 deploy NanoSlate in December 2024 against a Central European government entity. The malware is described specifically as a new espionage backdoor. The supporting content places its use in the context of broader China-aligned cyber espionage campaigns focused on European governmental targets, including EU and Central European government organizations. No additional high-confidence technical details on NanoSlate’s functionality, infection vector, persistence, command-and-control, or indicators of compromise are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
As recently as this month, ESET revealed in its latest APT Activity Report that APT31 targeted a Central European government entity in December 2024 to deploy an espionage backdoor referred to as NanoSlate.
1 distinct technique documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An espionage backdoor reportedly deployed by APT31 against a Central European government entity.
Espionage backdoor used by PerplexedGoblin against Central European government targets.
Espionage backdoor used by Chinese APT group PerplexedGoblin to target government entities.
Espionage backdoor used to compromise and maintain access to targeted government entities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.