Back to Threat Groups

nefilim

INACTIVE

ransomware group

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.

Victims
15
records
First Discovered
May 5, 2020
victim
Last Discovered
Sep 9, 2021
victim
Inactive Since
1,847
days
Countries
4
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Nov
2025
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
May
2026
Jun
2026
Jul
2026
Aug
2026
Sep
2026
Oct
2026

Victims (15)

Atlanta Allergy & Asthma. Part 1.

nefilim
Sep 9, 2021
Healthcare1.0Published

Grimmway Farms. Part 1.

nefilim
Sep 9, 2021
Agriculture and Food Production1.0Published

Elliott Group / Cascade Engineering / Unitex Textile Rental Services. Teaser.

nefilim
Sep 9, 2021
Manufacturing1.0Published

Seven Seas. Part 1.

nefilim
Sep 9, 2021
Consumer Services1.0Published

The MADSACK Media Group. Part 1.

nefilim
Sep 9, 2021
Business Services1.0Published

Tegut. Part 1.

nefilim
Sep 9, 2021
Consumer Services1.0Published

TPG Internet. Part 1.

nefilim
Sep 9, 2021
Telecommunication1.0Published

Saipa Press. Part 1.

nefilim
Sep 9, 2021
Manufacturing1.0Published

Tegut. Part 2.

nefilim
Sep 9, 2021
Consumer Services1.0Published

The MADSACK Media Group. Part 2.

nefilim
Sep 9, 2021
Business Services1.0Published

Whirlpool

nefilim
Dec 1, 2020
Critical Manufacturing1.0Published

DKA (refrigeration and air conditioning specialist, Dussmann Group subsidiary)

nefilim🇩🇪 DE
Jul 27, 2020
Critical Manufacturing1.0Published

Orange (mobile operator)

nefilim🇫🇷 FR
Jul 4, 2020
Communication1.0Published
orange.fr

Fisher and Paykel Appliances

nefilim🇳🇿 NZ
Jun 1, 2020
Critical Manufacturing1.0Published

Toll Group

nefilim🇦🇺 AU2 groups: netwalker
May 5, 2020
Transportation Systems1.0Published

Infrastructure

leak site
OFFLINE

malformed url

http://hxt254aygrsziejn.onion

4d ago