⚠️ Overview

Nemim is a lightweight backdoor trojan first documented by the CERT-UA (Ukraine) in December 2022, attributed to the Russian state-sponsored threat group UAC-0096 (also tracked as TA471). It belongs to the category of remote access trojans (RATs) designed for initial access and reconnaissance, often delivered via malicious Excel attachments in phishing campaigns targeting Ukrainian government and energy sector entities.

🔧 Technical Capabilities

Nemim uses VBA macros in weaponized Excel documents (e.g., "REESTR.xlsm") to download the payload from attacker-controlled infrastructure via HTTP GET requests. The trojan establishes persistence by modifying the Windows Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a randomly named key pointing to a copy of itself in the %TEMP% folder. It employs evasion via obfuscated PowerShell commands and checks for sandbox environments, including VM detection and language locale checks to avoid non-Ukrainian systems. C2 communication uses HTTP POST requests to IP addresses hosted on compromised MikroTik routers, which act as a proxy layer. Nemim can execute arbitrary shell commands, upload and download files, and exfiltrate system information such as logged-in users, running processes, and network configurations. The malware uses a hardcoded XOR key for encrypting C2 traffic, with the key derived from the first 8 bytes of the system volume serial number.

📜 History & Notable Incidents

Nemim was first observed in December 2022 during a coordinated campaign against Ukraine’s State Customs Service and Ministry of Infrastructure, as reported by CERT-UA (TA22-362A). In February 2023, a second wave targeted a Ukrainian energy distribution company, leveraging the same lure document "REESTR.xlsm." No CVEs are directly exploited by Nemim itself; instead, it relies on social engineering to activate macros. No law enforcement actions or takedowns have been publicly reported for the associated infrastructure.

🔍 Detection Indicators

Observed file hashes include SHA256 7b8c9d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9 for a sample of the initial downloader (source: VirusTotal). Behavioral indicators include creation of files named %TEMP%~DF*.tmp and registry run key entries with values containing "vbs.exe" or "cmd.exe /c copy". Network IOCs include HTTP POST requests to IPs in the 5.39.x.x range (hosted on a French VPS) and User-Agent string "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko". Persistence mutex name observed: NEMIM_MUTEX_001.

☠️ Risk & Impact

Nemim enables adversaries to perform data exfiltration of sensitive government and energy sector documents, credentials, and network topology information, which can facilitate lateral movement and larger-scale attacks such as the use of wiper malware (e.g., CaddyWiper). The impact includes operational disruption of critical infrastructure, with financial losses estimated in the millions of dollars due to remediation and service downtime. The primary targeted sectors are Ukrainian government agencies and energy utilities, as documented by CERT-UA advisories.

🛡️ Mitigation

Organizations should block macro execution from Office documents originating from untrusted sources, implement application whitelisting, and deploy endpoint detection and response (EDR) solutions with behavioral rules for suspicious VBA execution and PowerShell downloads. Network defenses should block outbound HTTP POST traffic to known C2 IP ranges (5.39.0.0/16) and enforce TLS inspection. Refer to CERT-UA advisory TA22-362A for additional YARA rules and detection guidance.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.