Nefilim Ransomware Threatens to Release Data

Unprepared Companies Vulnerable to Ransomware Attacks

March 26, 2020

A new ransomware called Nefilim that shares much of the same code as Nemty has started to become active and threatens to release stolen data.

According to a BleepingComputer report, Nefilim became active at the end of February 2020 and while it not known for sure how the ransomware is being distributed, it is most likely through exposed Remote Desktop Services. Head of SentinelLabs Vitali Krimez and ID Ransomware's Michael Gillespie both told BleepingComputer that Nefilim and Nemty 2.5 share much of the same code.

The main difference, adds the report, is that Nefilim now relies on email communications for payments rather than a Tor payment site and has removed the Ransomware-as-a-Service (RaaS) component.

In the Nefilim ransom note, the attackers state that if a user does not pay the ransom in seven days they will release data that was stolen from the network:

"A large amount of your private files have been extracted and is kept in a secure location. If you do not contact us in seven working days of the breach we will start leaking the data. After you contact us we will provide you proof that your files have been extracted."

In the past, adds BleepingComputer, this would have been seen as an empty threat, but with Maze, Sodinokibi, Nemty and more popular ransomware infections following through with their threats, it should no longer be ignored.

The New Jersey Cybersecurity & Communications Integration Cell recommends ensuring any sensitive data is encrypted at rest and in transit to protect data if exfiltrated. Additionally, to increase resiliency to ransomware infections, implement a defense-in-depth cybersecurity strategy and establish a comprehensive data backup plan that includes having multiple copies that are tested regularly and kept offline in a separate and secure location.

For more information, visit the BleepingComputer report.

You must login or register in order to post a comment.

ON DEMAND: DevSecOps creates an environment of shared responsibility for security, where AppSec and development teams become more collaborative. With the right training and tools, developers can become more hands-on with security and, with that upskilling, stand out among their peers... however, they need the security specialists on-side, factoring them into securing code from the start and championing this mindset across the company.

ON DEMAND: The insider threat—consisting of scores of different types of crimes and incidents—is a scourge even during the best of times. But the chaos, instability and desperation that characterize crises also catalyze both intentional and unwitting insider attacks. Learn how your workers, contractors, volunteers and partners are exploiting the dislocation caused by today's climate of Coronavirus, unemployment, disinformation and social unrest.

Security Magazine

2020 September

This month in Security magazine, we bring you our 2020 Most Influential People in Security annual report, where we highlight 22 industry leaders, their path to security, careers, goals and guidance for future security professionals. Industry experts discuss the evolution of ransomware, houses of worship security, cybersecurity standards, security careers in investigations and the unifying power of security. Diane Ritchey, past Editor-in-Chief, says goodbye and thank you to our readers.

View More Create Account

Nefilim Ransomware Threatens to Release Data

Related Articles

Related Events

Report Abusive Comment