DCSyncer.Slick

DCSyncer.Slick is a Windows post-exploitation utility used by the Iran-linked espionage actor UNC1549, also tracked as Nimbus Manticore and Subtle Snail, and described in broader reporting as part of the Tortoiseshell toolset. It is used to conduct DCSync-style attacks against Active Directory in order to extract NTLM password hashes directly from domain controllers, supporting privilege escalation and credential access objectives. Reporting describes it as a Windows utility based on DCSyncer that mimics the legitimate Active Directory replication feature. DCSyncer.Slick has been observed in intrusions targeting aerospace, aviation, and defense organizations across the Middle East, and related reporting also links the broader actor to telecommunications targeting. UNC1549 commonly gains initial access through spear-phishing, stolen credentials, abuse of third-party relationships, and access to remote platforms such as Azure Virtual Desktop, Citrix, and VMware. After compromise, the actor deploys DCSyncer.Slick alongside other custom malware and utilities including MINIBIKE, TWOSTROKE, DEEPROOT, LIGHTRAIL, GHOSTLINE, POLLBLEND, CRASHPAD, SIGHTGRAB, and TRUSTTRAP. Mandiant reported that UNC1549 abused DLL search order hijacking to execute DCSyncer.Slick and other payloads, often by masquerading malicious components as legitimate software from vendors such as FortiGate, Microsoft, NVIDIA, Citrix, and VMware, and in some cases installing legitimate software to facilitate the hijack. High-confidence capability information directly stated in the source is that DCSyncer.Slick extracts NTLM password hashes from domain controllers and is used for DCSync attacks for privilege escalation.