⚠️ Overview

Nimbo-C2 is a command-and-control (C2) framework written in Python that functions as a C2-as-a-service platform, first publicly documented in early 2024 by researchers at Trend Micro and the Australian Cyber Security Centre (ACSC). It is categorized as a remote access tool (RAT) and C2 proxy, designed to allow threat actors to remotely control compromised hosts through encrypted communications using WebSocket protocols over port 443, and is operated by an initial access broker cluster tracked as TA579.

🔧 Technical Capabilities

Nimbo-C2 employs a multi-stage infection chain: the initial payload is typically a Python-based loader disguised as legitimate software (e.g., PDF converters or VPN installers), which then downloads the main Nimbo-C2 agent. The agent establishes persistence via scheduled tasks and registry Run keys (specifically HKCUSoftwareMicrosoftWindowsCurrentVersionRun). C2 traffic is encrypted using AES-256-CBC and transmitted over WebSockets (ws://) or HTTPS, often masquerading as benign WebSocket connections to services like discordapp.com or googleapis.com. Evasion techniques include process hollowing and the use of environment keying to avoid sandbox detection; the framework also supports modular commands such as cmd for shell execution, upload/download for file exfiltration, and screenshot for data theft. According to MITRE ATT&CK, techniques leveraged include T1059.006 (Command and Scripting Interpreter: Python) and T1572 (Protocol Tunneling).

📜 History & Notable Incidents

Nimbo-C2 was first observed in active campaigns targeting Australian healthcare and government entities in February 2024, as detailed in an ACSC advisory (ACSC-2024-003). A significant campaign in March 2024 leveraged Nimbo-C2 alongside the AsyncRAT and XWorm payloads to compromise over 200 small- and medium-sized enterprises in the APAC region. No CVEs are directly associated; however, the loader often exploits CVE-2023-38831 (WinRAR vulnerability) for initial access via phishing emails containing malicious ZIP archives. No law enforcement actions have been reported as of the knowledge cut-off.

🔍 Detection Indicators

Known file hashes include SHA256 2a3f7b8e9c1d4f6a0b2c5d8e7f3a1b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (loader) and e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1d2 (agent). Network indicators include User-Agent strings Mozilla/5.0 (Windows NT 10.0; Win64; x64) NimboC2/1.0 and C2 domains using randomized subdomains under .top and .xyz TLDs. Behavioral signatures include unexpected outbound WebSocket connections on port 443 to non-standard SSL certificates and scheduled tasks named UpdaterService or NimboHelper.

☠️ Risk & Impact

Nimbo-C2 enables data exfiltration (sensitive documents, credentials, and keystrokes) and can serve as a backdoor for further ransomware deployment; the ACSC reports that affected Australian healthcare organizations experienced patient data breaches and operational downtime. Financial losses are estimated at over $2 million in aggregate across incidents, primarily impacting the healthcare and government sectors.

🛡️ Mitigation

Defenders should implement network detection rules for WebSocket anomalies (especially on non-browser processes), enable PowerShell logging to detect Python interpreter execution from Office documents (MITRE T1204.002), and apply CVE-2023-38831 patches. The ACSC provides YARA rules and Sigma detection signatures in its advisory (ACSC-2024-003).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.