Loading malware…
NimbleMamba is a C# implant used in targeted espionage operations attributed to TA402, also known as Molerats, a likely Palestinian-aligned threat actor. It emerged in campaigns observed from late 2021 into early 2022 and is assessed to be a successor to the group’s earlier LastConn backdoor. The malware has been used against Middle Eastern government entities, foreign policy think tanks, and a state-affiliated airline, consistent with intelligence-collection objectives in the Middle East and North Africa.
The implant is delivered through highly tailored spearphishing chains that use geofenced links and staged payload delivery to restrict access to intended victims. Observed delivery mechanisms included malicious archive files distributed through cloud-hosted links and actor-controlled web infrastructure. NimbleMamba is typically deployed as an obfuscated .NET executable and incorporates anti-analysis measures, including basic virtual-machine checks and regional guardrails that verify whether the infected host appears to be located in targeted countries or configured for Arabic-language use.
Operationally, NimbleMamba retrieves remote configuration data, uses Dropbox API-based communications for command-and-control, and exfiltrates data through the same service. Reported functionality includes screenshot capture, process enumeration, user-interaction checks, and retrieval of additional payloads, enabling follow-on tasking and continued access. Its design and deployment patterns indicate active development and selective use in persistent, victim-focused espionage campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ALUMINUM SARATOGA ... Tools ... BlackShades, BrittleBush, DarkComet, LastConn, Micropsia, NimbleMamba, PoisonIvy, QuasarRAT, XtremeRat
An advanced persistent threat (APT) hacking group operating with motives that likely align with Palestine has embarked on a new campaign that takes advantage of a previously undocumented implant called NimbleMamba.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
NimbleMamba is written in C# and delivered as an obfuscated .NET executable using third-party obfuscators.
NimbleMamba contains multiple guardrails to ensure that the malware only executes on targeted machines. | Additionally, the malware does basic virtual machine checks to avoid detection by looking for common strings that indicate a sample is running in a virtual environment.
The malware then takes the external IP address, username and computer name retrieved earlier, writes them as comma-separated strings, base64 encodes them with stripped padding bytes and then reverses the string.
Functionalities include capturing screenshots and obtaining process information from the computer.
Functionalities include capturing screenshots and obtaining process information from the computer.
NimbleMamba contains multiple guardrails to ensure that the malware only executes on targeted machines. | Additionally, the malware does basic virtual machine checks to avoid detection by looking for common strings that indicate a sample is running in a virtual environment.
the malware "uses the Dropbox API for both command-and-control as well as exfiltration," suggesting its use in "highly targeted intelligence collection campaigns."
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a tool used by the ALUMINUM SARATOGA threat profile.
NimbleMamba is a new implant used by the TA402 (Molerats) APT group for espionage purposes, likely providing remote access and control over compromised systems. It is used in targeted phishing campaigns with complex attack chains involving geofencing and URL redirects to evade detection.
A previously undocumented implant/backdoor used by Molerats (TA402) in highly targeted intelligence collection campaigns. It uses guardrails to ensure infected victims are within the target region and leverages the Dropbox API for command-and-control and exfiltration.
A C# .NET intelligence-gathering implant used by TA402/Molerats. It employs geofencing and language-based guardrails, checks for virtualized environments, retrieves configuration from JustPasteIt, and uses the Dropbox API for command-and-control, exfiltration, and payload delivery. It can capture screenshots, gather process information, detect user interaction, and download additional payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.