Loading threat actor…
Nemty was a ransomware operation active by at least 2019–2020 and is widely associated with the broader JSWorm/Nefilim lineage. It is notable for adopting data-theft extortion in addition to file encryption, threatening victims with publication of stolen unencrypted data if ransom demands were not met. Reporting and later comparative malware analysis have linked Nemty closely to subsequent or related operations including Nefilim, and to code relationships later observed in Karma and GangBang/Milihpen variants. Nemty operated within the modern ransomware ecosystem that combined encryption, leak-site pressure, and affiliate-style tradecraft seen across historical ransomware-as-a-service and private extortion schemes. It maintained web infrastructure for victim interaction and public pressure, and at least some of its infrastructure was protected through criminal proxy or fast-flux-style services. Comparative reporting has cited Nemty as an example of a ransomware brand that likely transitioned or rebranded into Nefilim. High-confidence tradecraft associated with the Nemty/Nefilim cluster includes encryption-based extortion, theft of victim data for coercion, post-compromise tooling for credential access and Active Directory discovery, and lateral movement within enterprise environments. Related reporting on the cluster references use of tools such as Mimikatz, LaZagne, NetPass, AdFind, BloodHoundAD, and PsExec, indicating credential theft, reconnaissance, and lateral movement in support of ransomware deployment. Nemty is best understood as a financially motivated ransomware actor within a broader evolving family of closely related extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware/ransomware family linked by similarity to Karma.
Ransomware operators used BraZZZers infrastructure to protect their domains and admin panel, with leaked logs exposing panel access and JWT tokens.
Mentioned as a historical example of ransomware rebranding.
Mentioned only as one of several other ransomware operations using leak-site or stolen-data extortion tactics.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.