THREAT ACTOR

NEFILIM_

Dormant

NEFILIM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of NEFILIM, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

10 Victims tracked

0 / 1 Active mirrors

2021-09-09 First listing

2021-09-09 Most recent

Victims by year

2021 10

Leak site mirrors

1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

hxt254aygrsziejn.onion snapshot · 2021-09-08 00:06

Recent victims

The 50 most recent victims claimed by NEFILIM. Total in the index: 10.

Date listed	Victim	Description
2021-09-09	Atlanta Allergy & Asthma. Part 1.
2021-09-09	Grimmway Farms. Part 1.
2021-09-09	Elliott Group / Cascade Engineering / Unitex Textile Rental Services. Teaser.
2021-09-09	Seven Seas. Part 1.
2021-09-09	The MADSACK Media Group. Part 1.
2021-09-09	Tegut. Part 1.
2021-09-09	TPG Internet. Part 1.
2021-09-09	Saipa Press. Part 1.
2021-09-09	Tegut. Part 2.
2021-09-09	The MADSACK Media Group. Part 2.

CONFIRMED ATTACKS

Nefilim confirmed attacks: 28 verified incidents

Ransomnews has verified 28 Nefilim incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2020 to May 2021. United States accounts for 8 of them (29%), with victims recorded in 12 countries in total. The most affected sector is service, at 5 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 4; the outcome is unrecorded in the remaining 24. Where a figure was disclosed (2 cases), these incidents account for 10,441 exposed records.

28Verified incidents

12Countries

2020–2021Active range

0%Paid, where outcome known

Confirmed victims by year

202021
20217

Most affected sectors

Service5
MAnufacturing4
Food and Beverage4
Healthcare4
Transportation3
Utilities3
Retail3
Other1

Most affected countries

United States8
France4
Germany3
Brazil3
India2
Australia2
Jamaica1
Switzerland1

Verified Nefilim incidents

Date	Organisation	Sector	Location	Records	Ransom paid	Source
May 2021	TPG Internet	Utilities	Sydney, Australia	—	Unknown	Source
April 2021	Tegut	Food and Beverage	Fulda, Germany	—	Unknown	Source
April 2021	Madsack GmbH & Co. KG (Madsack Media)	Service	Hanover, Germany	—	Unknown	Source
March 2021	Spirit Airlines, Inc.	Transportation	Florida, United States	—	Unknown	Source
March 2021	Grimmway Farms	Food and Beverage	California, United States	—	Unknown	Source
February 2021	Elliott Company	Manufacturing	Pennsylvania, United States	—	Unknown	Source
January 2021	Atlanta Allergy & Asthma	Healthcare	Georgia, United States	9,851	Unknown	Source
December 2020	Whirlpool Corporation	Manufacturing	Michigan, United States	—	Unknown	Source
November 2020	Colliers International Group	Finance	Toronto, Canada	—	Unknown	Source
October 2020	Beijer Ref Group	Retail	Saint Bonnet de Mure, France	—	Unknown	Source
October 2020	Beaver Street Fisheries, Inc.	Food and Beverage	Florida, United States	—	Unknown	Source
September 2020	Panpharma Group	Healthcare	Luitré, France	—	No	Source
September 2020	Luxottica	Healthcare	Milano, Italy	—	No	Source
September 2020	EWIE Group of Companies (EGC)	Service	Michigan, United States	590	Unknown	Source
September 2020	Burger King Jamaica	Food and Beverage	Kingston, Jamaica	—	Unknown	Source
August 2020	The SPIE Group	Service	Cergy-Pontoise, France	—	Unknown	Source
July 2020	Orange	Utilities	Paris, France	—	Unknown	Source
July 2020	Indoco Remedies Ltd	Healthcare	Mumbai, India	—	Unknown	Source
July 2020	Dresdner Kühlanlagenbau GmbH (DKA) (Dussmann Group)	MAnufacturing	Dresden, Germany	—	Unknown	Source
June 2020	Fisher & Paykel Appliances	Manufacturing	Auckland, New Zealand	—	Unknown	Source
May 2020	Toll Group	Transportation	Melbourne, Australia	—	No	Source
May 2020	Stadler Rail	Transportation	Bussnang, Switzerland	—	No	Source
May 2020	Arteris SA	Service	São Paulo, Brazil	—	Unknown	Source
May 2020	Aliansce Sonae	Retail	São Paulo, Brazil	—	Unknown	Source
April 2020	W&T Offshore, Inc.	Utilities	Texas, United States	—	Unknown	Source
April 2020	MAS Holdings	Retail	Colombo, Sri Lanka	—	Unknown	Source
April 2020	Aban Offshore	Service	Chennai, India	—	Unknown	Source
March 2020	Cosan	Other	São Paulo, Brazil	—	Unknown	Source

Claimed vs confirmed. The figures above the fold on this page come from Nefilim's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.