DCSYNCER.SLICK
DCSYNCER.SLICK is a Windows executable that is designed to gather credentials from victim devices.[1] DCSYNCER.SLICK was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1005 | Data from Local System |
DCSYNCER.SLICK has gathered stolen credentials in hardcoded filenames and pathways to include |
|
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
DCSYNCER.SLICK has staged stolen credentials in hard-coded local device paths to include |
| Enterprise | T1574 | .001 | Hijack Execution Flow: DLL |
DCSYNCER.SLICK has been executed using DLL search order hijacking.[1] |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Resource Name or Location |
DCSYNCER.SLICK has stored stolen credentials in legitimate resource locations to include |
| Enterprise | T1027 | .007 | Obfuscated Files or Information: Dynamic API Resolution |
DCSYNCER.SLICK has utilized dynamic API resolution to conceal functions.[1] |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
DCSYNCER.SLICK has XOR-encrypted stolen credentials prior to writing them to files.[1] |
||
| Enterprise | T1003 | .006 | OS Credential Dumping: DCSync |
DCSYNCER.SLICK has gathered credentials using DCSync Active Directory replication feature.[1] |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1059 | NIMBUS MANTICORE |
DCSYNCER.SLICK has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1] |