HOMETHREATSNymaim
APT / THREAT GROUP

Nymaim

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.

Threat Analysis

Nymaim is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/
→https://bitbucket.org/daniel_plohmann/idapatchwork
→https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/
→https://blog.talosintelligence.com/goznym/
→https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

win.nymaimNymaimnymain

External Intelligence

Malpedia: win.nymaim

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Nymaim