Nefilim ransomware extortion campaign targeting high-revenue businesses
Campaign
Summary
Hide ▲
Show ▼
The Nefilim ransomware campaign used an affiliate model that traded code access for 20% of ransom payments and focused on high-revenue businesses rather than indiscriminate targeting. Operators researched company revenue, size, and contact details before deploying tailored malware and threatening to publish stolen data on Corporate Leaks sites. Later, the U.S. Department of Justice charged Volodymyr Viktorovich Tymoshchuk as an administrator, and Artem Aleksandrovych Stryzhak later pleaded guilty to helping run the operation against victims in the U.S. and other countries.
Related Happenings
Conti campaign expands across multiple victims
Campaign
H score38
First: 12.06.2026 20:54
Last: 12.06.2026 20:54
Sources 1
About this happening:
The Conti ransomware operation ran as a large-scale 2021-2022 extortion campaign that stole data and encrypted devices to pressure victims into paying Bitcoin....
Conti campaign expands across multiple victims
CampaignAbout this happening: The Conti ransomware operation ran as a large-scale 2021-2022 extortion campaign that stole data and encrypted devices to pressure victims into paying Bitcoin....
Europol-led AudiA6 crypto-laundering takedown
Law Enforcement
H score29
First: 11.06.2026 18:55
Last: 11.06.2026 18:55
Sources 1
About this happening:
Law enforcement dismantled AudiA6, a cryptocurrency laundering service used by ransomware gangs and other cybercriminal networks, in a June 10, 2026 multinatio...
Europol-led AudiA6 crypto-laundering takedown
Law EnforcementAbout this happening: Law enforcement dismantled AudiA6, a cryptocurrency laundering service used by ransomware gangs and other cybercriminal networks, in a June 10, 2026 multinatio...
ShinyHunters Oracle PeopleSoft data theft and extortion campaign
Campaign
H score60
First: 10.06.2026 21:31
Last: 10.06.2026 21:31
Sources 1
About this happening:
ShinyHunters/UNC6240 used CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools as a zero-day to break into exposed systems, steal data, and extort victim...
ShinyHunters Oracle PeopleSoft data theft and extortion campaign
CampaignAbout this happening: ShinyHunters/UNC6240 used CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools as a zero-day to break into exposed systems, steal data, and extort victim...
Latest development: 29.06.2026 23:40
Nissan says attackers exploited an Oracle PeopleSoft vulnerability in a ShinyHunters-linked campaign and that the company was specifically targeted, with personal information for current and former employees in the United States, Canada, Mexico, and Brazil potentially exposed. Nissan says the material may include employee contact information, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary information, and the company has activated incident response, engaged external cybersecurity experts, secured affected systems, and is working with Oracle.
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor Meta
H score21
First: 07.06.2026 17:09
Last: 07.06.2026 17:09
Sources 1
About this happening:
Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
Silent Ransom Group shifts from Conti-linked ransomware participation to standalone data-theft extortion
Threat Actor MetaAbout this happening: Silent Ransom Group (UNC3753) is a standalone data-theft extortion actor that has operated separately since 2022 after the Conti shutdown, using stolen data and le...
Silent Ransom Group US law firm IT impersonation campaign
Campaign
H score36
First: 29.05.2026 16:00
Last: 29.05.2026 16:00
Sources 1
About this happening:
Silent Ransom Group (SRG), also tracked as UNC3753, Chatty Spider, and Luna Moth, is running a financially motivated data theft extortion campaign against do...
Silent Ransom Group US law firm IT impersonation campaign
CampaignAbout this happening: Silent Ransom Group (SRG), also tracked as UNC3753, Chatty Spider, and Luna Moth, is running a financially motivated data theft extortion campaign against do...
Timeline
-
22.12.2025 11:46 2 articles · 6mo ago
Initial report: Nefilim ransomware extortion campaign targeting high-revenue businesses
Initial DisclosureIn June 2021, access to the Nefilim code was traded for 20% of ransom payments, creating a repeatable affiliate-driven extortion workflow. The first phase focused on building target lists from company revenue and contact data before deploying tailored malware.
Show sources
- Ukrainian hacker admits affiliate role in Nefilim ransomware gang — www.bleepingcomputer.com — 22.12.2025 11:46
- INTERPOL Arrests 574 in Africa; Ukrainian Ransomware Affiliate Pleads Guilty — thehackernews.com — 23.12.2025 13:35
-
09.09.2025 19:08 1 articles · 10mo ago
U.S. Department of Justice charges Volodymyr Viktorovich Tymoshchuk over Nefilim ransomware operation
Legal Policy Action UpdateThe U.S. Department of Justice unsealed charges against Ukrainian national Volodymyr Viktorovich Tymoshchuk for serving as administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations. Prosecutors say he provided affiliates access to Nefilim in exchange for 20 percent of ransom proceeds, and the U.S. Department of State's Transnational Organized Crime Rewards Program offered up to $11 million for information leading to his location, arrest, or conviction.
Show sources
- US charges admin of LockerGoga, MegaCortex, Nefilim ransomware — www.bleepingcomputer.com — 09.09.2025 19:08