Loading story…
Nefilim emerged as a distinct ransomware operation built from Nemty 2.5 code, abandoning the earlier ransomware-as-a-service model in favor of private, targeted intrusions and email-based ransom negotiations. The malware encrypts files with AES-128 and protects keys with RSA-2048, appends the .NEFILIM extension, and drops NEFILIM-DECRYPT.txt, while also stealing data and threatening to publish it if victims do not pay. Researchers linked Nefilim to the broader JSWorm/Nemty/Nefilim lineage through shared cryptographic logic, ransom-note patterns, and infrastructure, showing a progression from mass distribution via the RIG exploit kit, spam, and the Trik/Phorpiex botnet to enterprise-focused attacks.
TTPs, infrastructure, and targeting history in one profile.
23 events from the most recent confirmed update back to the earliest known activity.
A cybersecurity industry source told BleepingComputer that Nefilim attacked Whirlpool during the first weekend of December 2020 and stole data before encrypting devices.
Whirlpool said it discovered ransomware in its environment in November 2020, contained the malware quickly, and later restored affected systems.
Qualys cites a May 2020 attack on Australia's Toll Group in which Nefilim allegedly leaked stolen data after the victim refused to pay.
By March 2020, Nefilim, CLOP, and Sekhmet had launched dedicated leak sites to publish stolen victim data from organizations that refused to pay.
Researchers documented Nefilim as a new ransomware family that encrypts files, threatens to leak stolen data if victims do not pay, and likely spreads through exposed RDP services.
Around March 2020, the operators rebranded the malware from Nemty to Nefilim and shifted to private affiliate cooperation for targeted extortion.
Nefilim activity began at the end of February 2020 as a new ransomware strain closely resembling Nemty 2.5 and using email-based ransom negotiations.
From the first half of 2020, the operators shut down the public ransomware-as-a-service model and shifted toward big-game hunting and targeted extortion.
Patches for CVE-2019-11634 and CVE-2019-19781 were released in January 2020, before later reports tied Nefilim intrusions to exploitation of unpatched Citrix systems.
The Citrix Gateway vulnerabilities CVE-2019-11634 and CVE-2019-19781, later cited as Nefilim intrusion vectors, were identified in December 2019.
In early October 2019, the Trik botnet started delivering Nemty to compromised systems and used an SMB-spreading component to propagate to additional hosts.
Nemty was first detected in August 2019, marking a substantial rewrite of the JSWorm lineage into a new branded ransomware family.
A July 2019 JSWorm 4.0.3 sample introduced RSA and a custom AES implementation, but remained decryptable because its pseudorandom number generator was not cryptographically secure.
From 2019 through the first half of 2020, JSWorm was run as a public ransomware-as-a-service operation and spread through channels including RIG exploit kit, Trik botnet, fake payment sites, and spam.
Researchers identified JSWorm in 2019 as the origin of a ransomware family that later rebranded multiple times, including as Nemty and Nefilim.
Over the weekend referenced in the report, Nefilim published stolen Whirlpool files on its leak site, including employee-related documents such as benefits, accommodation, medical, and background-check records.
Nef1lim-branded variants were documented on 14 July 2020 and again on 1 August 2020 using the .NEF1LIM extension and NEF1LIM-DECRYPT.txt ransom note.
Telegram-branded variants were documented on 15 June 2020 and 24 June 2020 using the .TELEGRAM extension and TELEGRAM-RECOVER.txt ransom note.
On 1 June 2020, a Sigareta variant was observed using the .SIGARETA extension and the ransom note SIGARETA-RESTORE.txt.
On 3 May 2020, an Offwhite variant was documented using the .OFFWHITE extension and the ransom note OFFWHITE-MANUAL.txt.
On 25 March 2020, a Nephilim-branded variant was documented using the .NEPHILIM extension and a ransom note named NEPHILIM-DECRYPT.txt.
The ID Ransomware profile states that Nefilim activity peaked in the first half to middle of March 2020.
By March 2020, the operators had created the Corporate Leaks/corpleaks.net site to publish stolen victim data as part of their double-extortion model.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 110 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceblog.qualys.com
Open sourcetrendmicro.com
Open sourcebleepingcomputer.com
Open sourcetrendmicro.com
Open sourcebleepingcomputer.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cryakl** ransomware family, also known as **Fantomas**, **Crykal**, and later **CryLock**, developed from early spam-driven attacks into a broader ransomware operation that encrypted files without needing live command-and-control communication and increasingly relied on affiliate-style distribution. Early campaigns targeted victims primarily in Russia, with additional activity in Germany, Kazakhstan, Ukraine, Belarus, Japan, and Italy, using phishing emails and malicious archives to deliver Delphi-based malware that encrypted portions of files, stored metadata locally, persisted through Windows registry keys, and in some cases installed the password-stealing trojan **`Trojan-PSW.Win32.Ruftar`** alongside the ransomware. Researchers also documented versions that used layered encryption with locally generated keys and hardcoded remote RSA public keys, allowing attackers to extort victims without any online key exchange. The operation later adopted tactics associated with modern **double extortion**. Deutsche Telekom linked at least one intrusion to a CryLock affiliate that encrypted a victim environment, displayed a pre-login legal warning, and threatened to publish stolen data through the **LOCKDATA Auction** leak marketplace, underscoring the shift from pure encryption to data-theft coercion. Separately, Belgian police seized Cryakl command-and-control servers and obtained private keys that enabled Kaspersky to expand decryption support in **RakhniDecryptor**, helping victims recover files from several Cryakl variants and disrupting one of the more prominent ransomware families active in Russia.
Aug 15, 2026
Researchers said **Nokoyawa** is a 64-bit Windows ransomware family that evolved from the **Karma/Nemty** line rather than being closely related to Hive, revising earlier assessments that had tied it to Hive mainly through overlapping intrusion tradecraft. SentinelLabs found Nokoyawa shares core code patterns with Karma, including multithreaded encryption, command-line driven execution, Base64-encoded keys and ransom notes, dynamic loading of `bcrypt.dll`, and elliptic-curve key exchange to derive **Salsa20** encryption keys. Earlier reporting had linked Nokoyawa to Hive because both were seen using tools such as **Cobalt Strike**, **GMER**, **PC Hunter**, **PowerShell**, and **PsExec**, but newer code-level analysis indicates those similarities are more consistent with a shared affiliate than a shared malware codebase. Zscaler documented Nokoyawa’s progression from early C/C++ builds to a **Rust** rewrite and identified multiple variants, including **Nokoyawa 2.0** and **Nevada** (`2.1`), which share more than 87% of their code. The newer strains use **Curve25519** in place of earlier curves, accept a Base64-encoded JSON configuration on the command line, support encryption of network shares via the `-network` parameter, and perform partial encryption to speed attacks while appending a 40-byte footer to encrypted files. Across variants, the malware uses an uncommon `DeviceIoControl` call with `IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE` to delete Windows Shadow Copies, while Nevada adds self-deletion and hardcoded encryption parameters; researchers also noted a flawed folder-hashing exclusion routine that can accidentally spare additional directories from encryption.
Aug 15, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026