Nefilim
Aliases: Nephilim
- Malware type
- ransomware
- Family
- Malware family
- Related IoCs
- 1 (1 malicious)
- Last IoC activity
- 2026-09-12 17:51:16
- Profile updated
- 2026-07-07 12:38:12
Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications transportation-and-logistics
Context
According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.
Detection coverage
- 5 YARA rules
Detection rules
- MALPEDIA_Win_Nefilim_Auto (yara-rule)
- TRELLIX_ARC_Nefilim_Ransomware (yara-rule)
- TRELLIX_ARC_Nefilim_Signed (yara-rule)
- TRELLIX_ARC_RANSOM_Nefilim_Go (yara-rule)
- DITEKSHEN_MALWARE_Win_Nemty (yara-rule)
Related threat objects
- Nemty (malware)
Reports & references
- secureworks.com — Gold Mansard (report)
- Mandiant — Financially Motivated Actors Are Expanding Access Into Ot (report)
- Mandiant — Financially Motivated Actors Are Expanding Access Into Ot (report)
- zdnet.com — A Deep Dive Into Nefilim A Double Extortion Ransomware Group (report)
- Trend Micro — Nefilim Modern Ransomware Attack Story (report)
- blog.qualys.com — Nefilim Ransomware (report)
- Trend Micro — Wp Modern Ransomwares Double Extortion Tactics (report)
- id-ransomware.blogspot.com — Nefilim Ransomware (report)
- intel471.com — How Cybercriminals Create Turbulence For The Transportation Industry (report)
- news.sophos.com — Nefilim Ransomware Attack Uses Ghost Credentials (report)
- bleepingcomputer.com — Home Appliance Giant Whirlpool Hit In Nefilim Ransomware Attack (report)
- bleepingcomputer.com — New Nefilim Ransomware Threatens To Release Victims Data (report)
- cert.govt.nz — Active Ransomware Campaign Leveraging Remote Access Technologies (report)
- intezer.com — Intezer 2020 Go Malware Round Up (report)
- picussecurity.com — How To Beat Nefilim Ransomware Attacks (report)
- Trend Micro — Nefilim Ransomware (report)
- Trend Micro — Nefilim Modern Ransomware Attack Story (report)
- Trend Micro — Nefilim Ransomware Threatens To Expose Stolen Data (report)
- ransomlook.io — Nefilim (report)
- labs.sentinelone.com — Meet Nemty Successor Nefilim Nephilim Ransomware (report)
- Kaspersky — 102428 (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- CISA — Aa20 345A (report)
- vulnerability.ch — Ransomware And Date Leak Site Publication Time Analysis (report)
- accenture.com — Evolving Danger Ransomware Extortion (report)