Ransomware group profile · #182 by claimed victims

Nefilim ransomware

According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.

Active First seen May 2020

15Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

4Countries hit

1Leak-site URLs tracked, 0 online

9 Sep 2021Latest claim recorded

Victimology

Who Nefilim claims to have breached, from 15 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing5

Retail & E-Commerce3

Professional Services2

Technology2

Transportation1

Healthcare1

Agriculture and Food Production1

Top countries

France1

New Zealand1

Australia1

Germany1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Atlanta Allergy & Asthma. Part 1. atlanta allergy & asthma. part 1.	Healthcare	—	9 Sep 2021
Grimmway Farms. Part 1. grimmway farms. part 1.	Agriculture and Food Production	—	9 Sep 2021
Elliott Group / Cascade Engineering / Unitex Textile Rental Services. Teaser. elliott group	Manufacturing	—	9 Sep 2021
Seven Seas. Part 1. seven seas. part 1.	Retail & E-Commerce	—	9 Sep 2021
The MADSACK Media Group. Part 1. the madsack media group. part 1.	Professional Services	—	9 Sep 2021
Tegut. Part 1. tegut. part 1.	Retail & E-Commerce	—	9 Sep 2021
TPG Internet. Part 1. tpg internet. part 1.	Technology	—	9 Sep 2021
Saipa Press. Part 1. saipa press. part 1.	Manufacturing	—	9 Sep 2021
Tegut. Part 2. tegut. part 2.	Retail & E-Commerce	—	9 Sep 2021
The MADSACK Media Group. Part 2. the madsack media group. part 2.	Professional Services	—	9 Sep 2021
Whirlpool	Manufacturing	—	1 Dec 2020
DKA (refrigeration and air conditioning specialist, Dussmann Group subsidiary)	Manufacturing	DE	27 Jul 2020

All 15 Nefilim victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Nefilim is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Nefilim ransomware still active?

Nefilim is tracked as active. The most recent leak-site claim VULONE recorded is dated 9 September 2021.

How many victims has Nefilim claimed?

VULONE has recorded 15 leak-site victim claims attributed to Nefilim since May 2020, across 4 countries and 7 sectors.

Which industries does Nefilim target?

The sectors most often named on the Nefilim leak site are Manufacturing, Retail & E-Commerce, Professional Services.

Which countries are most affected by Nefilim?

Most Nefilim victims recorded by VULONE are located in France, New Zealand, Australia.

Where does VULONE get Nefilim victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].