Full Report
Federal law enforcement officials accuse Artem Stryzhak, who was arrested in Spain last year, of attacking and extorting multiple companies between 2018 and 2021. The post Ukrainian extradited to US for alleged Nefilim ransomware attack spree appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Nefilim Ransomware Affiliates / Artem Stryzhak
## Attribution & Identity
The summary focuses on Artem Stryzhak, a Ukrainian national extradited to the US, who was allegedly part of an international ransomware scheme utilizing Nefilim ransomware. Stryzhak collaborated with "Nefilim administrators and affiliates."
## Activity Summary
Stryzhak and co-conspirators are accused of attacking and extorting multiple companies between late 2018 and late 2021. These attacks targeted organizations in the U.S., Canada, France, Germany, Australia, the Netherlands, Norway, and Switzerland. The scheme involved encrypting networks, stealing data, and threatening to leak the data online if ransom payments were not met. Stryzhak allegedly received 20% of the proceeds extorted from victims.
## Tactics, Techniques & Procedures
- **Encryption:** Used Nefilim ransomware to encrypt victim computer networks.
- **Data Exfiltration/Extortion:** Stole data and threatened to leak it online if victims refused to pay the ransom (Double Extortion).
- **Conspiracy:** Acted as part of an international scheme involving co-conspirators and Nefilim administrators.
- *Note: Specific MITRE ATT&CK IDs were not provided in the source text.*
## Targeting
- **Sectors:** Engineering consulting, aviation industry, chemical, insurance, construction, pet care, international eyewear, and oil and gas transportation.
- **Geography:** Attacks occurred in the U.S., Canada, France, Germany, Australia, the Netherlands, Norway, and Switzerland.
- **Victims:** High-revenue companies, specifically targeting those with more than $100 million in annual revenue in the U.S., Canada, or Australia were preferred. Specific US victims mentioned include a chemical company in Ohio, an insurance company in Illinois, a construction company in Texas, and a pet care company in Missouri.
## Tools & Infrastructure
- **Malware families used:** Nefilim ransomware.
- **Infrastructure (C2, domains, IPs - defang URLs):** Not specified in detail, other than the use of Nefilim infrastructure and C2 mechanisms related to the scheme.
## Implications
The successful extradition of Stryzhak demonstrates that international cybercriminals operating abroad cannot assume immunity from U.S. justice, even when running sophisticated, globe-spanning ransomware-for-profit operations. This indicates increased international cooperation leading to disruption of established cybercrime rings.
## Mitigations
- Implementing robust defenses against ransomware, focusing on data backup and recovery.
- Enhancing network security measures to counter data exfiltration prior to encryption.
- Recognizing and mitigating threats posed by high-revenue targets susceptible to double extortion tactics.