Nefilim

A Detailed Walkthrough of Ranzy Locker Ransomware TTPs

Ranzy Locker emerged as a ransomware-as-a-service operation and a rebranded successor to ThunderX, with some code and infrastructure overlap also linked to Ako. Researchers reported that the group adopted double extortion, stealing data before encrypting systems and threatening to publish it on the "Ranzy Leak" site if victims refused to pay. The malware used Salsa20 file encryption with RSA-2048-protected keys, appended extensions such as .ranzy and .RNZ, and directed victims to ransom notes and a Tor-based payment and support portal. Reporting tied Ranzy intrusions to phishing, exploitation of Microsoft Exchange, and abuse of RDP valid accounts and brute-force access. Once inside a network, the malware enumerated local and network drives, discovered shares, accessed credentials, deleted backups and shadow copies, and disabled recovery options to increase pressure on victims. An FBI flash report cited in one analysis said the gang had compromised more than 30 U.S. businesses across multiple sectors by July 2021, and researchers noted that no public decryptor was available at the time despite detailed mapping of the group's tactics to the MITRE ATT&CK framework.

Ranzy Ransomware | Better Encryption Among New Features of ThunderX Derivative - SentinelLabs

Popular hacking forum bans ransomware ads | The Record from Recorded Future News

The Russian-speaking cybercrime forum XSS banned all ransomware-related topics, including affiliate program advertisements, ransomware rentals, and sales of ransomware software. The forum’s administrator said ransomware had brought excessive publicity and law-enforcement attention to the site, with scrutiny intensifying after the DarkSide attack on Colonial Pipeline. Researchers cited in the reports said XSS had been one of the main underground venues used by ransomware groups to recruit affiliates and promote ransomware-as-a-service operations. The move drew negative reactions from representatives linked to REvil and LockBit, underscoring how important major forums were to the ransomware ecosystem. A day later, Exploit, another major Russian-language cybercrime forum, reportedly imposed a similar ban on ransomware advertisements. The back-to-back restrictions suggested that pressure from high-profile attacks, political fallout, and increased law-enforcement focus was forcing prominent underground platforms to distance themselves from overt ransomware promotion.

Evolution of JSWorm ransomware | Securelist

Nefilim emerged as a distinct ransomware operation built from Nemty 2.5 code, abandoning the earlier ransomware-as-a-service model in favor of private, targeted intrusions and email-based ransom negotiations. The malware encrypts files with AES-128 and protects keys with RSA-2048, appends the .NEFILIM extension, and drops NEFILIM-DECRYPT.txt, while also stealing data and threatening to publish it if victims do not pay. Researchers linked Nefilim to the broader JSWorm/Nemty/Nefilim lineage through shared cryptographic logic, ransom-note patterns, and infrastructure, showing a progression from mass distribution via the RIG exploit kit, spam, and the Trik/Phorpiex botnet to enterprise-focused attacks.

Popular Russian hacking forum XSS bans all ransomware topics

Nefilim Ransomware: Tactics, Impact, and Mitigation Strategies | Qualys

An Analysis of the Nefilim Ransomware | Trend Micro (US)

Home appliance giant Whirlpool hit in Nefilim ransomware attack