{
  "family": "tinynuke",
  "sample_count": 19,
  "category": "banking_trojan",
  "description": "TinyNuke (frequently documented in cybersecurity research as NukeBot, and tracked under signatures including Trojan:Win32/TinyNuke, Trojan.NukeBot, and Backdoor:Win32/TinyNuke) is an advanced modular banking trojan and HTTP botnet agent first identified in late 2016. Engineered to target online banking institutions, payment gateways, and cryptocurrency exchanges across Europe and North America, TinyNuke features an ultra-compact, high-performance C/C++ architecture. The malware injects custom DLL payloads into legitimate web browser processes (such as Google Chrome, Mozilla Firefox, and Internet Explorer). Utilizing Windows API hooks on network and SSL socket functions (such as PR_Write, HttpSendRequestW, and WS2_32 network routines), TinyNuke executes sophisticated Man-in-the-Browser (MitB) attacks. It intercepts online banking login credentials, alters web transaction data in real time, and injects rogue web forms to steal two-factor authentication (2FA) SMS codes and security tokens. Following the public leak of the author's complete source code repository in March 2017, numerous cybercriminal groups adapted the codebase for secondary downloader and credential theft operations.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/TinyNuke",
    "Trojan.NukeBot",
    "Backdoor:Win32/TinyNuke",
    "Win32/NukeBot",
    "TinyNuke Banking Trojan",
    "NukeBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/TinyNuke (NukeBot)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "TinyNuke (NukeBot) is a modular C/C++ banking trojan that injects into web browsers to steal banking credentials via Man-in-the-Browser attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How does TinyNuke intercept banking credentials and session tokens?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks browser network APIs (like PR_Write and HttpSendRequestW) to capture unencrypted HTTP/HTTPS traffic before SSL encryption."
      }
    },
    {
      "@type": "Question",
      "name": "What happened to TinyNuke after its source code leaked?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "After the source leaked in March 2017, multiple cybercriminal factions created modified variants for credential theft and botnet distribution."
      }
    },
    {
      "@type": "Question",
      "name": "How is TinyNuke distributed to victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed via malicious spam emails delivering macro-enabled Word documents and drive-by exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How can banking organizations protect customers from TinyNuke attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral fraud detection systems, implement FIDO2 hardware authentication, and monitor for unauthorized web inject modifications."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1056.004",
    "T1055.001",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Spam Emails with Macro Documents",
    "Drive-by Download Exploit Kits",
    "Secondary Malware Loaders"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Man-in-the-Browser (MitB) Web Injection",
    "Browser Network API Hooking (PR_Write, HttpSendRequestW)",
    "Dynamic DLL Injection into Browser Processes",
    "Encrypted Command & Control over HTTP/HTTPS",
    "Autostart Registry Run Key Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST traffic with RC4 or AES encrypted parameter payloads",
      "HTTP C2 requests retrieving real-time web inject configuration files"
    ],
    "evasion_techniques": [
      "Process hollowing and thread hijacking to evade behavioral detection",
      "Anti-debugging calls and sandbox detection via CPUID instruction inspection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b",
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TinyNukeClient"
    ],
    "file_paths": [
      "%AppData%\\TinyNuke\\client.exe",
      "%LocalAppData%\\Temp\\inject.dll"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint security software capable of detecting in-memory process injection and API hooking",
    "Implement phishing protection and email attachment sandboxing to block malicious Office documents",
    "Utilize hardware-backed multi-factor authentication (such as security keys) resistant to web inject interception"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/TinyNuke",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/TinyNuke"
    },
    {
      "name": "Trend Micro Security Research - Analyzing the NukeBot Banking Trojan",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/TinyNuke.A",
      "Trojan:Win32/TinyNuke.B",
      "Trojan.NukeBot.v2"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "credential_access",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Banking Credential Theft",
  "sample_hashes": []
}