Nefilim

Inactive

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.

15 Victims

May 4, 2020 First Discovered

Sep 9, 2021 Last Discovered

1878 Days Inactive

0% Infostealer

0/1 Sites Online

Known Locations (1)

hxt254aygrsziejn.onion

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (15)

Detailed victim list temporarily unavailable

This group has 15 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.