{
  "family": "dimnie",
  "sample_count": 13,
  "category": "trojan",
  "description": "Trojan:Win32/Dimnie is a highly stealthy, targeted espionage trojan that was notably active around 2017. Unlike broad-spray banking trojans, Dimnie was highly specialized, focusing specifically on exfiltrating source code, developer credentials, and intellectual property. It gained infamy for aggressively targeting software developers, system administrators, and specifically users active on platforms like GitHub.<br><br><b>Understanding Dimnie</b><br>To an infected developer, Dimnie is completely invisible. It is designed for long-term intelligence gathering, not immediate financial fraud or destruction. For a threat intelligence analyst, Dimnie represents a targeted supply chain threat. By compromising developers, the attackers aim to steal proprietary source code or inject malicious code into the victim organization's software products. Dimnie is notable for its extremely sophisticated modular architecture, where the core payload executes entirely in memory (fileless execution) to evade detection.<br><br><b>Execution and Espionage Mechanics</b><br>Dimnie is typically distributed via highly tailored spearphishing emails targeting developer email addresses, often masquerading as job offers or urgent bug reports with weaponized attachments (`T1566.001`). Upon execution of the initial dropper, it utilizes advanced process hollowing (`T1055.012`) to inject its core module directly into legitimate system processes (like `explorer.exe`). It establishes persistence via hidden Scheduled Tasks. The core module then reaches out to the C2 to download specialized espionage plugins directly into memory (`T1620`). These plugins include advanced keyloggers (`T1056.001`), clipboard monitors (looking for copied API keys or passwords), and modules specifically designed to search the hard drive and network shares for source code files (e.g., `.cpp`, `.py`, `.sln`) and exfiltrate them (`T1005`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating loss of intellectual property and potential supply chain compromise. Incident responders will find little to no trace of the main payload on the hard drive. Detection relies heavily on EDR behavioral analysis. Look for anomalous network traffic originating from `explorer.exe` (or similar core processes) communicating over non-standard ports or using heavily disguised HTTP traffic. Memory forensics (RAM dumping) is absolutely critical to extract the active Dimnie modules and identify the exfiltrated data.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1005",
    "T1055.012",
    "T1056.001",
    "T1620",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading (Fileless execution of plugins)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Source code theft)",
      "tactic": "Collection"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; an active Dimnie infection means an advanced threat actor is actively stealing source code and credentials.",
    "Assume all local credentials, SSH keys, GitHub tokens, and AWS access keys present on the machine are compromised. Revoke them immediately.",
    "Capture a full forensic memory image (RAM dump) to extract the fileless espionage plugins and determine exactly what data was targeted for exfiltration.",
    "Perform a complete bare-metal rebuild of the operating system; fileless malware leaves persistence hooks that are extremely difficult to guarantee removed."
  ],
  "what_to_avoid": [
    "Do not assume the code repositories accessed by the victim are safe; audit all recent commits made by the compromised user for malicious injections.",
    "Avoid relying on standard antivirus scans, as Dimnie's core logic and plugins exist almost entirely in volatile memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}