Nimplant

nimplant > shell whoami

Implant console written in Nim: executes commands on the compromised host with a small binary that is less signed by AVs.

Run it when you need a lightweight implant in a language that AVs sign less than C#/.NET: Nim binaries have few static signatures. NimPlant supports AES encryption of tasks and direct syscalls to evade EDR hooks.

If the blue team has rules for binaries with Nim runtime (e.g., .nim section or NimMain) or egress filters by IP, the implant will be detected. It is a younger C2 than Cobalt Strike: fewer post-exploitation modules and a smaller community.