Search threats, CVEs… ⌘K
← Back to all threat actors

nefilim

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.

How we source and review actor profiles
Motivation
ransomware
Last seen
2021-09-09
Sectors
manufacturing, retail-e-commerce, technology, professional-services, transportation, agriculture-and-food-production, healthcare
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimAtlanta Allergy & Asthma. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGrimmway Farms. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimElliott Group / Cascade Engineering / Unitex Textile Rental Services. Teaser. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSeven Seas. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe MADSACK Media Group. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTegut. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTPG Internet. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSaipa Press. Part 1. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTegut. Part 2. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe MADSACK Media Group. Part 2. listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator1 indicator cataloged

Types: onion.

Claimed
Victim claimWhirlpool listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimDKA (refrigeration and air conditioning specialist, Dussmann Group subsidiary) listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimOrange (mobile operator) listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimFisher and Paykel Appliances listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimToll Group listed by nefilim

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

nefilimCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...