Nimplant

Nimplant is a deprecated cross-platform implant for the Mythic command-and-control framework, written in Nim and designed for Linux and Windows environments. It was developed as a red-team and post-exploitation agent and is primarily associated with Mythic 2.1, with deprecation stemming from lack of maintenance for newer Mythic compatibility rather than from a change in core functionality.

Nimplant operates as an asynchronous implant over an HTTP C2 profile and provides a lightweight set of post-exploitation capabilities. Supported operator actions include filesystem navigation and manipulation, file upload and download, process listing and termination, shell command execution, environment variable inspection and modification, job management, and configurable sleep behavior. Its command set makes it suitable as an early-stage foothold or general-purpose backdoor for interactive operations after initial compromise.

The malware has also been referenced in intrusion activity involving a modified Nim-based backdoor assessed as likely derived from Nimplant. In that observed use, the derivative implant supported file operations, execution of files through bash, and collection of system information, indicating adaptation for real-world post-compromise operations beyond its original open-source red-team context.

Nimplant is notable for being implemented in Nim and for targeting both Windows and Linux, but it is not characterized by extensive built-in evasion tradecraft in its documented form. Planned but not established capabilities included macOS support, WebSocket communications, screenshot capture, shellcode generation through Donut integration, and remote process injection. In its documented state, Nimplant is best characterized as a lightweight post-exploitation implant/backdoor used for command execution, host interaction, and operator-controlled follow-on activity.