Nymaim
Aliases: nymain
- First seen
- 2013-03-01 00:00:00
- Malware type
- downloader, ransomware, trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-22 01:18:48
- Profile updated
- 2026-07-07 12:56:02
Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality
Targeted regions: country_code:us country_code:de country_code:ru
Context
Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Nymaim_Auto (yara-rule)
Reports & references
- securityintelligence.com — Meet Goznym The Banking Malware Offspring Of Gozi Isfb And Nymaim (report)
- blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
- lawfareblog.com — What Point These Nation State Indictments (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Nymaim (report)
- arielkoren.com — Nymaim Deep Technical Dive Adventures In Evasive Malware (report)
- justice.gov — Goznym Cyber Criminal Network Operating Out Europe Targeting American Entities Dismantled (report)
- www2.deloitte.com — Us Aers The Evolution Of The Nymaim Criminal Enterprise (report)
- Cisco Talos — Goznym (report)
- cert.pl — Nymaim Revisited (report)
- securityintelligence.com — Goznym Closure Comes In The Shape Of A Europol And Doj Arrest Operation (report)
- shadowserver.org — Goznym Indictments Action Following On From Successful Avalanche Operations (report)
- virusbulletin.com — Linking Xpaj And Nymaim (report)
- proofpoint.com — Nymaim Config Decoded (report)
- proofpoint.com — What Old New Again Nymaim Moves Past Its Ransomware Roots 0 (report)
- sentinelone.com — Goznym Banking Malware Gang Busted (report)
- bitbucket.org — Idapatchwork (report)
- public.gdatasoftware.com — 004 Plohmann (report)
- github.com — Nymaim (report)