Full Report
A Ukrainian national has been extradited from Spain to the United States to face charges over allegedly conducting Nefilim ransomware attacks against companies. [...]
Analysis Summary
# Threat Actor: Nefilim Ransomware Operators
## Attribution & Identity
The article focuses on criminal activity associated with the Nefilim ransomware, specifically detailing the extradition of a Ukrainian national charged in connection with these attacks (identified later in the article as Stryzhak, though the summary focuses on the group's actions).
**Known Aliases and Associated Groups:** Nefilim is believed to have later rebranded under several names, including:
* Fusion
* Milihpen
* Gangbang
* Nemty (Nefilim shared significant code with Nemty)
* Karma
## Activity Summary
Nefilim affiliates operate by breaching corporate networks, exfiltrating stolen data, and then encrypting devices using the ransomware payload. They demand Bitcoin ransom for both the decryption key and to prevent the public release of the stolen data. If the ransom is refused, the attackers publish the data on designated data leak sites. The Nefilim ransomware first launched in 2020.
## Tactics, Techniques & Procedures
Specific TTPs directly related to the ransomware encryption and data leak operations:
* **Data Exfiltration:** Stealing data prior to encryption.
* **Double Extortion:** Encrypting files and threatening to leak stolen data.
* **Encryption Method:** Encrypted files using AES-128 encryption.
* **File Modification:** Appended the ".NEFILIM" file extension to encrypted files.
* **Ransom Negotiation:** Created ransom notes named "NEFILIM-DECRYPT.txt" throughout the file system, setting a non-negotiation deadline of seven days before data would be leaked.
## Targeting
* **Sectors:** The article explicitly mentions organizations in logistics/transportation (Toll Group) and manufacturing (Whirlpool), suggesting a focus on large enterprises.
* **Geography:** No specific geographic focus is detailed, but the extradition of a Ukrainian national suggests connections to Eastern Europe, while the victims (Toll Group, Orange, Whirlpool) are globally recognized entities.
* **Victims:**
* Toll Group
* Orange
* Whirlpool
## Tools & Infrastructure
* **Malware Families Used:** Nefilim ransomware (which shares code with Nemty).
* **Infrastructure (C2, domains, IPs):** None specifically detailed in the provided text snippet, other than the existence of "data leak sites" used for publishing exfiltrated data.
## Implications
The Nefilim campaign demonstrates a mature double-extortion strategy leveraging pre-existing ransomware code (Nemty) for operational efficiency. The willingness of law enforcement to extradite actors involved suggests increased international cooperation against high-impact ransomware operations, increasing legal risk for operators linked to these criminal enterprises.
## Mitigations
* Implement multi-layered defenses focused on preventing initial network access (though specific initial vectors are not detailed).
* Establish incident response plans that address data exfiltration protocols in addition to system restoration.
* Maintain immutable, segmented backups to minimize pressure from the double-extortion tactic.
* Monitor for the presence of ".NEFILIM" file extensions and "NEFILIM-DECRYPT.txt" ransom notes.