APT / THREAT GROUP

Nullmixer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Nullmixer is a dropper/loader for additional malware. It is known to drop a vast amount of different malware, such as info stealers, rats and additional loaders. Samples observed contained up to 8 additional payloads.

Threat Analysis

Nullmixer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1

→https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/

→https://www.youtube.com/watch?v=92jKJ_G_6ho

→https://www.youtube.com/watch?v=v_K_zoPGpdk

→https://www.youtube.com/watch?v=yLQfDk3dVmA

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.nullmixerNullmixer

External Intelligence

Malpedia: win.nullmixer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Nullmixer