Nemty ransomware operation shuts down

guest · Apr 15, 2020

Nemty ransomware operation shuts down
April 15, 2020
https://www.zdnet.com/article/nemty-ransomware-operation-shuts-down/

The operators of the Nemty ransomware have announced this week they were shutting down their service after ten months in operation, ZDNet has learned from a source in the infosec community.
For those unfamiliar with this malware operation, Nemty is a classic RaaS (Ransomware-as-a-Service).

If any of the victims who had computers infected with Nemty paid the ransom demand, the Nemty operator kept 30% of the payment, while the distributors got %70 for their efforts.
NEMTY SHUTS DOWN AFTER 10 MONTHS
But in an update posted on a dedicated topic on the Exploit hacking forum, the Nemty operator announced yesterday they were shutting down their service.

The Nemty operator gave victims a week to pay the ransom demands before the ransomware would shut down its infrastructure, and users would be unable to decrypt their files, even if they wanted to pay.
Click to expand...

The fact that Nemty is shutting down is no surprise for the cyber-security community. There are multiple reasons for this.

First is that the ransomware failed to establish itself as a top player on the ransomware market.
Second, Nemty has also suffered a big reputational hit back in October 2019 when Tesorion security researchers decrypted three of its versions.
Third, the Nemty crew saw the writing on the wall after Tesorion released its free decryptors and appear to have moved on to developing a new strain from scratch.

As reported by SentinelLabs' Vitali Krimez and ID Ransomware's Michael Gillespie, the new Nefilim ransomware that was released last month appears to be based on Nemty's code. [...] there was no reason for the Nemty gang to keep the old one around.
Click to expand...

guest · May 5, 2020

Nefilim/Nephilim Could Soon Fill the Gap Left by NEMTY’s Termination
NEMTY closed down and passed its code to Nefilim, a new type of ransomware that’s already causing trouble
May 5, 2020
https://www.technadu.com/nefilim-nephilim-could-soon-fill-gap-left-by-nemty-termination/100942/

Only about three weeks ago, we reported on the closure of the NEMTY project – at least as far as its RaaS (ransomware as a service) operations are concerned. The authors of the successful strain decided to go private and hunt bigger fish, while they shared the source code of NEMTY with a selection of individuals who reportedly spewed “Nefilim.”
A Sentinel Labs report tries to shed light on the new strain, how it works, what encryption protocols it uses, and how much of NEMTY does it have at its core.

Nefilim first appeared in March 2020, and initially, it shared much of NEMTY’s code without significant changes.
From Nefilim came Nephilim, which is almost the same ransomware strain – so technically, the researchers are treating them as a single entity.
Click to expand...

That said, Nefilim is another data-breaching headache that can’t be dealt with backups or decrypters alone.
Nefilim received the code of NEMTY, a powerful ransomware strain, and so it could start doing business right away. We don’t know if the group behind the new ransomware is interested in launching a RaaS platform or not, but from the first steps, it doesn’t seem like they are going for it.
Click to expand...

SentinelLabs: Meet NEMTY Successor, Nefilim/Nephilim Ransomware

Log in or Sign up

Nemty ransomware operation shuts down

guest Guest

guest Guest

Log in or Sign up

Nemty ransomware operation shuts down

guest Guest

guest Guest

Useful Searches