Article
What Should You Know About Ransomware
Ransomware is an easy way to profit since attackers directly demand ransom. They do not have to infiltrate sensitive data and sell them to…
Read more
Ransomware group profile
Nefilim Ransomware: Profile, Tactics and the Stryzhak Case
Nefilim was a ransomware-as-a-service operation that stole data, encrypted networks and threatened to publish what it took.
- Inactive
In short
Nefilim was a ransomware-as-a-service operation that stole data, encrypted networks and threatened to publish what it took. The US Department of Justice says its administrators gave affiliates access in return for a percentage of ransom payments; affiliate Artem Stryzhak agreed to pay 20%. On 27 October 2026 a US court sentenced him to 70 months in prison.
- StatusInactiveas reported
- Entry Routes4ways inCredentials and movement · Switching off defences · Data theft before encryption
- Techniques7mapped to MITRE ATT&CKExternal Remote Services · OS Credential Dumping
- Defences6first steps listedPatch internet-facing gateways · Protect and watch credentials
Overview
Nefilim was a ransomware-as-a-service operation. Trend Micro says it was first discovered in March 2020 and believes it is an evolved version of the older Nemty ransomware. The US Department of Justice (DOJ) says Volodymyr Tymoshchuk was one of its administrators from about July 2020 through October 2021.
Administrators supplied the ransomware and an online panel for affiliates. Affiliates carried out the intrusions and paid a share of what victims paid. The DOJ says one affiliate, Artem Stryzhak, paid 20% of his ransom proceeds in exchange for access to the ransomware.
The DOJ says the administrators preferred victims in the United States, Canada or Australia with more than 100 million US dollars in annual revenue. In July 2021 Tymoshchuk urged Stryzhak to aim at companies with more than 200 million dollars. The DOJ adds that Tymoshchuk researched targets in online databases for their net worth, size and contact details.
Nefilim used double extortion. After gaining access, the actors stole data. The DOJ says the ransom notes threatened to publish it on public “Corporate Leaks” websites run by the administrators unless the victim reached an agreement.
On 27 October 2026 a federal court in Brooklyn sentenced Stryzhak to 70 months in prison. He pleaded guilty in December 2025 to conspiracy to commit fraud, extortion and related activity in connection with computers. The DOJ says he joined Nefilim as an affiliate in about June 2021 and deployed it through at least October 2021. He was also one of the earliest affiliates of Hive ransomware.
Tymoshchuk is charged and not in custody. The US State Department offers up to 11 million dollars for information that leads to his arrest, conviction or location. The same indictment also charges him over two other strains, LockerGoga and MegaCortex. For the wider topic, see our ransomware glossary entry.
Timeline
- March 2020
Trend Micro says Nefilim was first discovered, and believes it evolved from the older Nemty ransomware.
- July 2020
The DOJ says Tymoshchuk was one of the Nefilim administrators from about this month through October 2021.
- June 2021
The DOJ says Stryzhak joined Nefilim as an affiliate and agreed to pay the administrators 20% of ransom proceeds.
- July 2021
The DOJ says Tymoshchuk urged Stryzhak to target companies in the US, Canada or Australia with more than 200 million dollars in annual revenue.
- October 2021
The DOJ says Stryzhak deployed Nefilim through at least this month, and that Tymoshchuk was one of the administrators until about this month.
- June 2024
Stryzhak is arrested in Spain, per the DOJ.
- 30 April 2025
Stryzhak is extradited to the United States, per the DOJ.
- 9 September 2025
A superseding indictment against Tymoshchuk is unsealed, and the State Department offers up to 11 million dollars for information.
- December 2025
Stryzhak pleads guilty to conspiracy to commit computer fraud and related offences.
- 27 October 2026
A federal court in Brooklyn sentences Stryzhak to 70 months in prison.
How they get in
- 01
Exposed Remote Desktop and Citrix
Trend Micro says Nefilim was largely known to reach systems through exposed RDP. It also names the Citrix flaw CVE-2019-19781 and brute-forced RDP as ways in. In its 2020 incident notes, Trend Micro lists entry through a Citrix vulnerability or RDP, followed by a local exploit to gain higher privileges.
- 02
Credentials and movement
Trend Micro lists Mimikatz, LaZagne and NirSoft NetPass for credentials, and PsExec or WMI for moving between machines. AdFind, BloodHound and SMBTool were used to map the network. Its 2020 notes also mention Cobalt Strike.
- 03
Switching off defences
Trend Micro says the actors used PC Hunter, Process Hacker and Revo Uninstaller to stop security processes and services before encryption.
- 04
Data theft before encryption
Trend Micro says data was copied to a local folder, packed with 7-Zip and uploaded with MEGAsync. The DOJ says the actors stole data once they had enough access to the victim network.
How they extort
Double extortion. The DOJ says Nefilim ransom notes typically threatened that, unless the victim came to an agreement, the stolen data would be published on public "Corporate Leaks" websites kept by the Nefilim administrators. The DOJ says victims who paid received a decryption key. In its plea release it adds that a unique ransomware file, with its own key and ransom note, was made for each victim.
Techniques
- Technique Archive Collected Data Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. T1560 · Collection
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
How to defend
-
Close remote desktop to the internet
Trend Micro says Nefilim was largely known to reach systems through exposed RDP. Put RDP behind a VPN or gateway with multi-factor authentication, and remove accounts with weak passwords.
-
Patch internet-facing gateways
Trend Micro names Citrix CVE-2019-19781 as an entry point. Patch gateways and remote access appliances first, and check them for signs of earlier compromise.
-
Protect and watch credentials
Credential dumping with Mimikatz is listed in Trend Micro's analysis. Limit local administrator rights, enable credential protection and alert on dumping tools.
-
Alert on remote execution tools
PsExec, WMI and AdFind appear in the intrusions Trend Micro studied. Alert on them where administrators do not normally use them.
-
Watch for bulk uploads to cloud storage
Trend Micro reports MEGAsync for data exfiltration, with 7-Zip archives made first. Alert on large archives and on traffic to file-sharing services.
-
Keep tamper protection on security tools
Trend Micro says the actors stopped security services before encrypting. Turn on tamper protection, and keep offline backups that you have tested.
Questions
What is Nefilim ransomware?
Nefilim is a ransomware-as-a-service operation. Trend Micro says it was first discovered in March 2020 and uses double extortion. The US Department of Justice says its administrators gave affiliates access in return for a share of each ransom.
Who was sentenced for Nefilim attacks?
On 27 October 2026 a federal court in Brooklyn sentenced Artem Stryzhak to 70 months in prison. The DOJ says he was a Nefilim affiliate from about June 2021 and also one of the earliest Hive affiliates.
How much of the ransom did Nefilim affiliates pay the administrators?
The DOJ says Stryzhak agreed to pay the Nefilim administrators 20% of the ransom proceeds he collected, in exchange for access to the ransomware.
How did Nefilim get into networks?
Trend Micro says it was largely known to reach systems through exposed RDP, and it also names the Citrix flaw CVE-2019-19781 and brute-forced RDP as entry points.
Is Nefilim related to Nemty?
Trend Micro believes Nefilim is an evolved version of the older Nemty ransomware. Treat this as the vendor's assessment, not a government finding.
In our research
- What Should You Know About Ransomware September 2022
- Double extortion Glossary term
Sources
- Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies US Department of Justice, EDNY
- Ransomware Administrator Charged with Cybercrimes for Deploying Lockergoga, Nefilim, and Megacortex Ransomware Strains Against Hundreds of Victims US Department of Justice, EDNY
- Ukrainian National Pleads Guilty to Conspiracy to Use Nefilim Ransomware to Attack Companies in the United States US Department of Justice
- Nefilim Ransomware Trend Micro
- Updated Analysis on Nefilim Ransomware's Behavior Trend Micro
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.