Loading malware…
Nimplant is a deprecated cross-platform implant for the Mythic command-and-control framework, written in Nim and designed for Linux and Windows environments. It was developed as a red-team and post-exploitation agent and is primarily associated with Mythic 2.1, with deprecation stemming from lack of maintenance for newer Mythic compatibility rather than from a change in core functionality.
Nimplant operates as an asynchronous implant over an HTTP C2 profile and provides a lightweight set of post-exploitation capabilities. Supported operator actions include filesystem navigation and manipulation, file upload and download, process listing and termination, shell command execution, environment variable inspection and modification, job management, and configurable sleep behavior. Its command set makes it suitable as an early-stage foothold or general-purpose backdoor for interactive operations after initial compromise.
The malware has also been referenced in intrusion activity involving a modified Nim-based backdoor assessed as likely derived from Nimplant. In that observed use, the derivative implant supported file operations, execution of files through bash, and collection of system information, indicating adaptation for real-world post-compromise operations beyond its original open-source red-team context.
Nimplant is notable for being implemented in Nim and for targeting both Windows and Linux, but it is not characterized by extensive built-in evasion tradecraft in its documented form. Planned but not established capabilities included macOS support, WebSocket communications, screenshot capture, shellcode generation through Donut integration, and remote process injection. In its documented state, Nimplant is best characterized as a lightweight post-exploitation implant/backdoor used for command execution, host interaction, and operator-controlled follow-on activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cluster 8 (Active since at least March 10, 2026), which deploys the KScan asset mapping tool and Nim-based backdoor that's likely based on NimPlant and comes with capabilities to perform file operations, execute files using bash, and collect system information
Cluster 8 (Active since at least March 10, 2026), which deploys the KScan asset mapping tool and Nim-based backdoor that's likely based on NimPlant and comes with capabilities to perform file operations, execute files using bash, and collect system information
Cluster 8 (Active since at least March 10, 2026), which deploys the KScan asset mapping tool and Nim-based backdoor that's likely based on NimPlant and comes with capabilities to perform file operations, execute files using bash, and collect system information
CVE-2026-20182 carries a CVSSv3.1 score of 10.0 (Critical) and is classified under CWE-287: Improper Authentication. The flaw affects the Cisco Catalyst SD-WAN Controller (formerly vSmart)... The peering authentication mechanism is not functioning correctly, allowing an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on the affected system.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
shell shell [command] Run a shell command which will translate to a process being spawned with command line: cmd.exe /r[command]
cp cp [source] [destination] Copy a file from source to destination... mv mv [source] [destination] Move a file from source to destination... rm rm [path] Remove a file specified by [path]
ipconfig List IP address information of the currently selected NimPlant.
getenv getenv Get all of the current environment variables.
Hunting C2/Adversaries Infrastructure with Shodan and Censys ... My research Cobalt Strike C2 Metasploit/MSF Covenant C2 Deimos C2 Posh C2 Brute Ratel C4 Mythic C2 Sliver C2 ... Night Hawk C2 NimPlant C2 ShadowPad C2 Infrastructure Async Rat C2 Infrastructure Meterpreter C2 Infrastructure
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Nim-based backdoor, or likely derivative, used for file operations, bash execution, and system information collection on compromised devices.
A Nim-based backdoor used in post-exploitation against Cisco Catalyst SD-WAN targets.
An open-source Nim-based implant/backdoor referenced as the likely basis for a modified post-compromise implant with expanded file, execution, and system reconnaissance capabilities.
The content references NimPlant C2 infrastructure as part of adversary infrastructure hunting.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.