Nemty

First seen
2019-08-30 00:00:00
Malware type
ransomware
Family
Malware family
Last IoC activity
2026-05-28 02:46:55
Profile updated
2026-07-07 12:58:29

Context

A new ransomware family dubbed “Nemty” for the extension it adds to encrypted files has recently surfaced in the wild. According to a report from Bleeping Computer, New York-based reverse engineer Vitali Kremez posits that Nemty is possibly delivered through exposed remote desktop connections.

Detection coverage

  • 7 YARA rules

Detection rules

  • TRELLIX_ARC_Nemty_Ransomware (yara-rule)
  • TRELLIX_ARC_Nemty_Ransomware_2_6 (yara-rule)
  • ARKBIRD_SOLG_RAN_Nemty_June_2021_1 (yara-rule)
  • DITEKSHEN_MALWARE_Win_Nemty (yara-rule)
  • DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty (yara-rule)
  • CAPE_Nemty (yara-rule)
  • MALPEDIA_Win_Nemty_Auto (yara-rule)

Related threat objects

Reports & references

  • CrowdStrike — Report2021Gtr (report)
  • secureworks.com — Gold Mansard (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • bleepingcomputer.com — Three More Ransomware Families Create Sites To Leak Stolen Data (report)
  • cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
  • cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
  • ESET — Eset Threat Report Q22020 (report)
  • Trend Micro — Nemty Ransomware Possibly Spreads Through Exposed Remote Desktop Connections (report)
  • github.com — Nemty.Md (report)
  • labs.sentinelone.com — Meet Nemty Successor Nefilim Nephilim Ransomware (report)
  • medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
  • medium.com — The Nemty Affiliate Model 13F5Cf7Ab66B (report)
  • raw.githubusercontent.com — 2019 08 24 Nemty Ransomware Notes.Vk.Raw (report)
  • Kaspersky — 102428 (report)
  • Broadcom/Symantec — Nemty Ransomware Trik Botnet (report)
  • bleepingcomputer.com — Fake Paypal Site Spreads Nemty Ransomware (report)
  • bleepingcomputer.com — Nemty Ransomware Decryptor Released Recover Files For Free (report)
  • bleepingcomputer.com — Nemty Ransomware Gets Distribution From Rig Exploit Kit (report)
  • bleepingcomputer.com — New Nemty Ransomware May Spread Via Compromised Rdp Connections (report)
  • fortinet.com — Nemty Ransomware Early Stage Threat (report)
  • lastline.com — Nemty Ransomware Scaling Up Apac Mailboxes Swarmed Dual Downloaders (report)
  • McAfee — Nemty Ransomware Learning By Doing (report)
  • ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
  • sentinelone.com — Karma Ransomware An Emerging Threat With A Hint Of Nemty Pedigree (report)
  • sentinelone.com — Nokoyawa Ransomware New Karma Nemty Variant Wears Thin Disguise (report)

External references