Nefilim

Nefilim, also widely referred to as Nephilim, was a ransomware operation active from 2020 that used an affiliate-based model and became associated with the broader shift toward double extortion. The group is commonly assessed as a successor or rebrand of Nemty and has also shown technical and ecosystem overlap with related JSWorm-family variants such as GangBang and Milihpen. Nefilim targeted large enterprises and other high-revenue organizations, including corporations in North America, Europe, and Australia, and publicly pressured victims through leak-site publication of stolen data when ransom demands were not met. The operation combined data theft with file encryption and tailored attacks to individual victims. Administrators provided affiliates with access to the ransomware and supporting infrastructure in exchange for a share of ransom proceeds. Victim selection emphasized larger companies, with reporting indicating a focus on organizations exceeding major annual revenue thresholds. Known victims include Whirlpool, and reporting also links the group to attacks affecting organizations in the United States and several European countries. Nefilim intrusions have been associated with lateral movement and post-compromise tooling common in enterprise ransomware operations. Reported behaviors include data exfiltration prior to encryption, use of PsExec for lateral movement, deployment of Cobalt Strike infrastructure, and use of credential-access and network-discovery tools such as Mimikatz, BloodHoundAD, AdFind, NetPass, and LaZagne. The malware ecosystem evolved across many closely related builds and extensions, indicating sustained development and repeated reconfiguration of keys, certificates, and branding. Fast-flux infrastructure has also been associated with Nefilim attacks. Law-enforcement actions have tied the operation to Ukrainian nationals. U.S. authorities alleged that Volodymyr Tymoshchuk acted as an administrator of Nefilim, in addition to LockerGoga and MegaCortex, while Artem Stryzhak pleaded guilty for his role as a Nefilim affiliate. These cases describe an organized ransomware enterprise in which administrators supplied malware and affiliates conducted intrusions and extortion. Nefilim’s use of affiliate operations, customized victim builds, and double extortion helped shape tactics that later became standard across the ransomware ecosystem.