Nefilim Ransomware: Tactics, Impact, and Mitigation Strategies | Qualys
Summary: Nefilim ransomware emerged in March 2020 when Nemty operators left the ransomware-as-a-service model for more targeted attacks, and the new family appears based on Nemty's code, sharing similarities with Nemty version 2.5. It gains initial access through brute-forced exposed RDP setups and Citrix gateway vulnerabilities CVE-2019-11634 and CVE-2019-19781, then uses tools including PsExec, Mimikatz, LaZagne, and NirSoft's NetPass to move laterally and exfiltrate data before encrypting files with AES-128 and appending a key encrypted by an embedded RSA-2048 public key.
Bottom line: Nefilim exfiltrates sensitive data before encryption and posts it on the dark web when ransoms go unpaid, as it did to Toll Group after the shipping organization refused to pay following an earlier Netwalker attack. Backups do not cover that exposure, so the theft of data before encryption is the stake a security leader has to weigh.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-11634CVE-2019-19781
- Related
- CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021