Skip to main content
Darkfield

Operator dossier

Nefilim is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 15 public victims claimed by this operator between May 5, 2020 and September 9, 2021. Nefilim is a ransomware group that emerged in May 2020, operating as a financially motivated cybercriminal organization that has targeted at least 15 documented victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major security firms, though their operational patterns suggest they function as an independent ransomware operation rather than a confirmed Ransomware-as-a-Service model. Nefilim employs double extortion tactics, stealing sensitive data from victims before deploying their ransomware payload, and threatens to publish exfiltrated information on leak sites if ransom demands are not met, with their attacks primarily focusing on critical manufacturing, media, transportation systems, and communications sectors. The group has demonstrated a geographic targeting preference for Germany, France, New Zealand, and Australia, suggesting either regional operational focus or specific victim selection criteria within these countries. Due to the limited public documentation from major threat intelligence providers, detailed information about specific high-profile campaigns, attack vectors, and current operational status remains sparse in open-source reporting from established security research organizations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Nefilim

All 15 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Nefilim →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Nefilim

15 victims indexed · first seen 6 years ago · last activity 5 years ago

15
Victims indexed
#186 of 364 tracked operators
1y 4m
Active period
May 2020 → Sep 2021
4
Countries hit
top Germany · 1

At a glance

Status
inactive
First seen
6 years ago
Last activity
5 years ago
Onion sites
1 known endpoint
Primary sector
Critical Manufacturing · 3 hits

About

Nefilim is a ransomware group that emerged in May 2020, operating as a financially motivated cybercriminal organization that has targeted at least 15 documented victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major security firms, though their operational patterns suggest they function as an independent ransomware operation rather than a confirmed Ransomware-as-a-Service model. Nefilim employs double extortion tactics, stealing sensitive data from victims before deploying their ransomware payload, and threatens to publish exfiltrated information on leak sites if ransom demands are not met, with their attacks primarily focusing on critical manufacturing, media, transportation systems, and communications sectors. The group has demonstrated a geographic targeting preference for Germany, France, New Zealand, and Australia, suggesting either regional operational focus or specific victim selection criteria within these countries. Due to the limited public documentation from major threat intelligence providers, detailed information about specific high-profile campaigns, attack vectors, and current operational status remains sparse in open-source reporting from established security research organizations.

References

32 links

External sources curated by the MISP threat-intel community.

Timeline

5 months
2020-05-01T00:00:00+00:00 · 12020-06-01T00:00:00+00:00 · 12020-07-01T00:00:00+00:00 · 22020-12-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 10
2020-05-01T00:00:00+00:002021-09-01T00:00:00+00:00

Top countries

🇩🇪 Germany
1
🇫🇷 France
1
🇳🇿 New Zealand
1
🇦🇺 Australia
1
Germany dossier →France dossier →New Zealand dossier →Australia dossier →

Top sectors

Critical Manufacturing
3
Media
2
Transportation Systems
1
Communication
1
Critical Manufacturing dossier →Media dossier →Transportation Systems dossier →Communication dossier →

MITRE ATT&CK

6 techniques · 6 tactics

Tactics

Initial AccessExecutionDefense EvasionCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://hxt254aygrsziejn.onion

Source

Updated 5 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Nefilim posts a victim.

Add Nefilim to your watchlist — Pro pings you within 5 minutes of any new Nefilim leak-site post, Telegram callout, or affiliate-rebrand inference.