{"id":2282,"date":"2021-06-16T11:46:34","date_gmt":"2021-06-16T02:46:34","guid":{"rendered":"https:\/\/cyberenso.jp\/?page_id=2282"},"modified":"2021-07-05T20:48:10","modified_gmt":"2021-07-05T11:48:10","slug":"nephilim-ransomware","status":"publish","type":"page","link":"https:\/\/cyberenso.jp\/en\/types-of-ransomware\/nephilim-ransomware\/","title":{"rendered":"Nephilim Ransomware"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

NEPHILIM (NEFILIM) RANSOMWARE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"ransomware-2318381_1920\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Introduction<\/span><\/strong><\/h4>

Nephilim ransomware, which is also known as Nefilim, made its first appearance in 2020 as it was being distributed through the targeting vulnerabilities in Citrix gateway devices.
Attacks involving the Nephilim ransomware have been frequent and have been recorded to target organisations of medium to large size from many countries.
There is no decryptor for any of the active variants of the Nephilim ransomware and the average ransom required is $701,494 which can be paid via emails addresses provided in the ransomware note. <\/p>

Modus Operandi<\/span><\/strong><\/h3>
Initial access<\/span><\/strong><\/h5>

The threat actor uses two ways of gaining initial access: targeting exposed Remote Desktop Protocol (RDP) setups by brute-forcing them or exploiting known vulnerabilities like CVE-2019-11634 and CVE-2019-19781 in Citrix gateway devices. As soon as the threat actor gains initial access, they download Nephilim ransomware, files, and exfiltration tools: Mimikatz, AdFind and Cobalt Strike.
The threat actor then uses the Mimikatz tool to harvest credentials for lateral movement, and then use the AdFind tool to explore Active Directory when they reach it. The threat actor also downloads and run Cobalt Strike to assistance with the lateral movement. After mapping the target network, the threat actor will copy the data from servers and shared network directories to a local directory on a compromised machine where the data is compressed with a 7zip binary. Then MEGAsync is installed which is used to synchronizes folders between the compromised machine and a cloud drive owned by the threat actor. And therefore, the threat actors can exfiltrate the 7zip compressed data file out of the target\u2019s network. <\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
Installation<\/strong><\/h5>

The threat actors use Psexec.exe to executes remote commands that allow for them to execute batch (.bat) files. They would execute multiple batch files to spread the Nephilim ransomware and a batch file that would kill processes and stop services, to as many machines as possible via copy command or WMI.<\/p>

Encryption<\/strong><\/h5>

When Nephilim is executed, it starts to encrypt all the target files using a combination of AES-128 and RSA-2048 algorithms. Firstly, the files are encrypted using AES-128 encryption and then AES encryption key is encrypted using the RSA-2048 public key. Then the key is appended to the executable (.exe) file of the ransomware.
As soon as all the target files are encrypted, Nephilim drops a ransom note \u2018NEFILIM-DECRYPT.txt\u2019 that give instructions to the victim on how to recover their files. <\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

NEPHILIM (NEFILIM) RANSOMWARE Introduction Nephilim ransomware, which is also known as Nefilim, made its first appearance in 2020 as it was being distributed through the targeting vulnerabilities in Citrix gateway devices. Attacks involving the Nephilim ransomware have been frequent and have been recorded to target organisations of medium to large size from many countries. There is no decryptor for any [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":2284,"parent":3201,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-2282","page","type-page","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/pages\/2282"}],"collection":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/comments?post=2282"}],"version-history":[{"count":15,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/pages\/2282\/revisions"}],"predecessor-version":[{"id":3373,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/pages\/2282\/revisions\/3373"}],"up":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/pages\/3201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media\/2284"}],"wp:attachment":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media?parent=2282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}