Loading story…
Multiple public repositories and technical blogs show Nim being actively used to build offensive tooling for Windows and Linux, including malware loaders, command-and-control agents, and post-exploitation utilities. GitHub projects such as OffensiveNim, Nimbo-C2, PichichiH0ll0wer, and NimBlackout document capabilities including shellcode execution, process hollowing, token impersonation, credential dumping, in-memory PowerShell execution, encrypted HTTP C2, Linux memfd loading, and BYOVD-based attempts to disable AV/EDR. Several projects also emphasize evasion tradecraft such as AMSI and ETW patching, syscall-based injection, anti-debugging, obfuscated sleep, reflective loading, and reducing static imports to lower detection.
Separate malware-development walkthroughs further demonstrate Nim-based payload encryption and execution techniques using RC4, RC5, and TEA, as well as callback abuse through EnumDesktopsA and remote process injection into mspaint.exe. The examples rely on common Windows APIs for memory allocation, payload staging, and thread creation, and were presented as proof-of-concept code compiled with Nim and MinGW for x64 Windows targets. Taken together, the material shows Nim maturing from a niche language into a practical platform for malware authors and red-team developers seeking native binaries, cross-compilation, and flexible access to low-level Windows functionality.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published Nimbo-C2, a lightweight command-and-control framework with a Nim-based Windows and Linux agent and Python server components, supporting capabilities such as in-memory PowerShell, shellcode injection, persistence, token impersonation, and credential dumping.
A GitHub repository published PichichiH0ll0wer, a Nim-based process hollowing loader for x64 PE payloads supporting EXE and DLL output, encrypted and compressed payloads, anti-debugging, and multiple hollowing methods including direct and indirect syscalls.
A technical blog post published a Nim proof of concept that pads, encrypts, and decrypts an embedded shellcode payload with TEA, verifies the decrypted bytes, and executes the payload through EnumDesktopsA on Windows.
A technical blog post published a Nim proof of concept that encrypts embedded shellcode with RC5, decrypts it, and executes it from RWX memory via EnumDesktopsA on Windows 10 22H2 x64.
A technical blog post published a Nim example that allocates shellcode with VirtualAlloc, copies it with RtlMoveMemory, and executes it in memory by passing it as an EnumDesktopsA callback on Windows 11.
A technical blog post published a Nim malware proof of concept that encrypts a payload with RC4, decrypts it, and injects it into a newly started mspaint.exe process using OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
A GitHub repository named OffensiveNim was published describing experiments in weaponizing the Nim language for offensive operations, including malware, implants, shellcode execution, injection, AMSI/ETW bypass, credential access, and evasion tradecraft.
The NimBlackout GitHub repository showed updates to README.md and NimBlackout.nim for a Nim proof of concept that uses the gmer/Blackout.sys vulnerable driver to disable AV/EDR processes via a BYOVD technique.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
nim-lang.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026
Emotet continued to evolve from a banking trojan into a resilient modular malware platform, using phishing and thread-hijacked emails to deliver malicious Office files, password-protected ZIP archives, oversized documents, OneNote attachments, and later `.LNK` shortcut files. Multiple analyses showed operators repeatedly changing initial access and execution methods: older campaigns relied on VBA or XLM macros, while later waves used embedded VBScript, JavaScript, and shortcut-based loaders to fetch DLL payloads from hard-coded URLs and execute them with LOLBins such as `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `cmd.exe`, `PowerShell`, and `certutil.exe`. Researchers also documented a shift from earlier "Project X" payloads to a newer "Project Y" core DLL, alongside continued use of thread hijacking and downloader chains designed to blend into normal Windows activity. Technical reporting showed Emotet actively bypassing common defenses and maintaining a mature post-infection capability set. One Word-document sample used WMI so that `cmd.exe` was spawned by `WmiPrvSe.exe` instead of directly by Word, sidestepping Microsoft Defender's Office child-process Attack Surface Reduction rule; another macro deobfuscated strings, launched WMI-backed process creation, and ran a base64-encoded PowerShell downloader. Across samples, the malware established persistence through Registry Run keys or Windows services depending on privilege level, used process hollowing, browser credential theft modules, encrypted command-and-control with embedded RSA/AES or ECC-based protections, and rotated hard-coded C2 infrastructure. Defenders were advised to block password-protected archives and macro-enabled documents where possible, hunt for WMI-originated process creation, and monitor for suspicious use of `regsvr32.exe`, `rundll32.exe`, and other LOLBins tied to Emotet delivery chains.
Aug 15, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026