BazarNimrod

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A rewrite of Bazarloader in the Nim programming language.

Threat Analysis

BazarNimrod is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811

→https://medium.com/walmartglobaltech/nimar-loader-4f61c090c49e

→https://twitter.com/James_inthe_box/status/1357009652857196546

→https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-backdoors-rats-loaders-evasion-techniques

→https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-old-dogs-new-tricks.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

BazarNimrodNimzaLoaderwin.bazarnimrod

External Intelligence

Malpedia: win.bazarnimrod

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BazarNimrod