NefilimMalware
- nephilim
According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.From MISP Galaxy
Last reported 1 month ago, by Risky Business News2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1552.004Private Keys
“The modules loaded malicious code that extracted and stole crypto-wallet private keys.”
- T1684Social Engineering
“Rust warns of ongoing social engineering campaign: The Rust programming language warns that a threat actor is targeting its core members and owners of popular libraries.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Risky Bulletin: Gemini hacked three companies too“Authorities say the 52-year-old IT specialist worked as a coder for the LockerGoga, MegaCortex and Nefilim ransomware groups.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“…r’s cybercriminal career, which began in 2019, farnetwork has been involved in several connected ransomware projects, including JSWORM, Nefilim, Karma, and Nemty, as part of which they helped develop ransomware and manage the RaaS programs before launching their own RaaS program…”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- exploit[.]inin 1 report
- pentest-tools[.]comin 1 report
- onionmail[.]comin 1 report
- marktsec.bsky[.]socialin 1 report
- sethmlarson[.]devin 1 report
- shakirov2036.bsky[.]socialin 1 report
- pwn[.]aiin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.