Another week another new ransomware! 

This latest one was discovered by researchers working from SentinelLabs and it has been dubbed Nefilim.

Based on the initial research, it seems to share significant portions of its code base with an older strain, Nemty 2.5.

The two key differences between the two strains

  1. Nefilim's code does not contain the Ransomware-as-a-Service (RaaS) found in Nemty 2.5
  2. Nefilim relies on email communication to arrange ransom payment, rather than routing those through the TOR browser.

The researchers spotted Nefilim in the wild at the end of February 2020. At this point, it's unclear exactly how the malware is being distributed. The best guess at this point is that the malware is being spread via exposed Remote Desktop Services. However, the malware winds up on a target system.

If it gets on a computer, the victim will see the following note

"A large number of your private files have been extracted and are kept in a secure location. If you do not contact us in seven working days of the breach we will start leaking the data. After you contact us we will provide you proof that your files have been extracted."

This tactic is becoming increasingly common, and as we've seen in recent months, it's not an idle threat. Worse is that based on the analysis of the code to this point, Nefilim is secure. That means that at present, there's no free way to recover your files once they have been encrypted.

Our perspective

While this strain isn't especially widespread at this point, it's a legitimate threat. It would be a grave mistake to ignore it.

~ As Hill Street Blues' Sgt. Esterhaus always advised: "Hey, let's be careful out there! " ~


Meanwhile, check out this report

This free executive report may give you insights into how to build your business with safe IT environments: 10 Hidden IT Risks That Might Threaten Your Business and 1 Easy Way to Find Them

The author

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available on LinkedIn, Facebook, and Twitter.

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT SupportI am Denis Wilson, President and Principal Consultant for DWP Information Architects. I help professionals grow their business by building a foundation of rock-solid information solutions for smaller healthcare, insurance, financial, legal, and nonprofits firms in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance. I am also a published author and speaker, working extensively with a variety of organizations, as well as providing small business technology education programs through business and professional associations. This just in: I will be speaking regularly at California Lutheran University's Center for Nonprofit Leadership starting in September.

Contact me if you would like me to speak at your association