NimPlant
5 hosts convicted as NimPlant command-and-control servers: 5 still listed, 0 archived. First seen 2026-08-28.
About
A lightweight open-source first-stage implant, written in Nim and since 2024 in Rust as well, which compiles to native binaries of a few hundred kilobytes. Its author published it openly as a learning project and states plainly that evading endpoint detection is NOT a goal of the stock build. What is listed here is the controller, so a NimPlant listing identifies a first-stage server rather than a full post-exploitation suite — the project's own instructions tell operators to modify it before use, so the stock posture is not a claim about anyone here.
Ports
Detection packs
Rules for this hub's 5 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.