Loading story…
Nymaim evolved from a ransomware-associated threat into a flexible malware downloader delivered primarily through phishing emails, including campaigns that abused a legitimate bulk email marketing service to improve delivery and evade blacklist-based defenses. Victims were lured into opening malicious Word documents or links to macro-enabled files, after which Nymaim installed and frequently fetched additional payloads such as the Ursnif banking Trojan; one observed infection chain dropped Pony first and then used it to retrieve Nymaim. Researchers also noted that the malware retained web-injection capabilities aimed at banking sessions and continued to use heavy in-memory obfuscation to complicate analysis and detection.
Later analysis showed Nymaim also overhauled its command-and-control resilience with a new wordlist-based domain generation algorithm (DGA) seeded by a hard-coded key and date values, producing domains across an 11-day sliding window with 64 domains per day alongside 46 hard-coded domains. The malware avoided exposing direct C2 addresses by transforming DNS A records into IPs, validating responses with a checksum mechanism, and screening NS records for sinkhole-related keywords before connecting. Once infrastructure was selected, the sample sent encrypted HTTP POST traffic to a hard-coded /index.php endpoint using AES and asymmetric encryption, underscoring Nymaim's transition into a more stealthy and resilient banking-malware delivery platform.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By 2014, researchers identified Nymaim-infected machines that also contained Vawtrak, Miuref, Pony, and Ursnif. This showed Nymaim functioning as a downloader capable of installing multiple malware families.
A new Nymaim version was observed in April 2018. The variant dropped most prior custom obfuscation, slightly changed its IP transformation constants, and completely rewrote its domain generation algorithm.
The analyzed Nymaim executable carried a compile timestamp of 2018-03-02 23:12:20. This sample was later examined as part of research into a substantially updated Nymaim variant.
In recent campaigns described by Proofpoint, threat actors used a legitimate bulk email marketing service to distribute Nymaim via malicious document attachments or links to macro-enabled documents. Proofpoint noted this marked a shift from Nymaim's more typical botnet-based spam distribution and improved delivery by leveraging trusted infrastructure.
On February 17, researchers tracked a malicious attachment campaign using Word documents with lures such as "February payment" and "Fedex Delivery Notification." The macros dropped Pony, which was then used to download Nymaim.
Nymaim was first observed in 2013. Early activity associated it with ransomware distribution before later campaigns emphasized its downloader role.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint researchers detailed how the **Nymaim** malware family uses an unusual encrypted configuration format built as compiled bytecode and executed by a custom virtual machine embedded in the malware. The analysis shows Nymaim has evolved from a ransomware-style screen locker and downloader into a more capable downloader with **information-stealing** and **system-profiling** functions, giving operators a flexible way to change behavior without rebuilding the core malware. The decoded configuration revealed operational logic including integrity checks, timestamps, versioning, expiration dates, conditional branches, procedure calls, and API-like functions tied to the malware’s main components. Researchers also identified anti-debugging and anti-analysis checks for antivirus processes, sandbox-related libraries, virtual-machine MAC addresses, and suspicious usernames or hostnames, along with payload drop paths, process exclusion lists, DNS settings, and command-and-control domains and URLs that can help defenders detect and track Nymaim activity.
Aug 14, 2026
Researchers documented **Ramnit** as a Zeus-like banking trojan, worm, and file infector that was distributed through the **Blackhole exploit kit** and equipped with rootkit capabilities, spam-sending functions, and aggressive persistence. Analysis of multiple samples showed the malware dropping several components, installing a fake **"Mi cor soft Windows Service"**, injecting into `svchost.exe`, and in some cases infecting executable and HTML files by appending malicious code. One sample was tied more closely to botnet and spam activity, while another emphasized file infection, a combination that made reliable cleanup difficult and led researchers to recommend full system rebuilds rather than partial remediation. The reporting also showed that Ramnit used resilient command-and-control methods, including communications over port `443` with a custom encoded protocol rather than SSL and large fallback domain lists to find active servers. Separate reverse engineering of the malware's **domain generation algorithm (DGA)** found that Ramnit generated variable-length `.com` domains using a simple linear congruential generator and multiple observed 32-bit seeds, including `0xEF214BBF`, `0x28488EEA`, `0x4BFCBC6A`, and `0x79159C10`. Investigators linked parts of the infrastructure to pharma spam operations, noted overlap with previously documented Ramnit C2 servers, and reported that while one command server had been sinkholed, other infrastructure remained active.
Aug 15, 2026
Researchers detailed ongoing activity by **Numando**, a Latin American banking trojan written in Delphi that has been active since at least 2018 and primarily targets victims in Brazil, with less frequent campaigns in Mexico and Spain. The malware is commonly delivered through spam emails carrying ZIP attachments with MSI installers, then launched via **DLL side-loading** using a legitimate application, an injector, and an encrypted payload. Once installed, Numando displays fake banking overlays to capture sensitive information and supports a broad set of backdoor functions, including simulating mouse and keyboard actions, taking screenshots, killing browser processes, and restarting or shutting down the infected machine. The malware also uses several distinctive tradecraft elements, including numeric command identifiers, decoy ZIP archives with encrypted URLs hidden in ZIP comments, BMP images used to conceal payloads in overlays, and remote configuration data stored on public services such as **YouTube** and **Pastebin**, encrypted with keys hardcoded in the binary.
Aug 14, 2026