MALWARE FAMILY

Nymaim

Internal ID: win.nymaim

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.

Threat Analysis

Nymaim is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/

→https://bitbucket.org/daniel_plohmann/idapatchwork

→https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/

→https://blog.talosintelligence.com/goznym/

→https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim

→https://public.gdatasoftware.com/Web/Landingpages/DE/GI-Spring2014/slides/004_plohmann.pdf

→https://securityintelligence.com/meet-goznym-the-banking-malware-offspring-of-gozi-isfb-and-nymaim/

→https://securityintelligence.com/posts/goznym-closure-comes-in-the-shape-of-a-europol-and-doj-arrest-operation/

→https://www.cert.pl/en/news/single/nymaim-revisited/

→https://www.justice.gov/opa/pr/goznym-cyber-criminal-network-operating-out-europe-targeting-american-entities-dismantled

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.nymaim

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Nymaim