- Home
- Detectable Ransomware
- Nefilim
Ransomware Research
Nefilim Ransomware
Nefilim is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on March 1, 2020, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Nefilim, Nefilim Doxware, Nephilim, Offwhite, Sigareta, Telegram, Nef1lim, Mefilin, Trapget, Merin, Fusion, Infection, Milihpen, Derzko, Gangbang, Kiano, Mansory.
Quick Facts
- Ransomware Family
- Nefilim
- First Seen
- March 1, 2020
- Known Aliases
- NefilimNefilim DoxwareNephilimOffwhiteSigaretaTelegramNef1limMefilinTrapgetMerinFusionInfectionMilihpenDerzkoGangbangKianoMansory
How Nefilim Ransomware Works
File Encryption Patterns
Nefilim modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..NEFILIM..NEPHILIM..OFFWHITE..SIGARETA..TELEGRAM..NEF1LIM..MEFILIN..TRAPGET..MERIN..FUSION..INFECTION..MILIHPEN..DERZKO..GANGBANG..BENTLEY..KIANO..MANSORY..f1..LEAKS..PUSSYRansom Note and Payment Demands
After encrypting files, Nefilim displays ransom notes demanding payment for file recovery:
NEFILIM-DECRYPT.txtRansom message:
notes/NEFILIM-DECRYPT.txt
Note locations:
EveryFolderNEPHILIM-DECRYPT.txtRansom message:
notes/NEPHILIM-DECRYPT.txt
Note locations:
EveryFolderOFFWHITE-MANUAL.txtRansom message:
notes/OFFWHITE-MANUAL.txt
Note locations:
EveryFolderSIGARETA-RESTORE.txtRansom message:
notes/SIGARETA-RESTORE.txt
Note locations:
EveryFolderTELEGRAM-RECOVER.txtRansom message:
notes/TELEGRAM-RECOVER.txt
Note locations:
EveryFolderNEF1LIM-DECRYPT.txtRansom message:
notes/NEF1LIM-DECRYPT.txt
Note locations:
EveryFolderMEFILIN-README.txtTRAPGET-INSTRUCTION.txtRansom message:
notes/TRAPGET-INSTRUCTION.txt
Note locations:
EveryFolderMERIN-DECRYPTING.txtRansom message:
notes/MERIN-DECRYPTING.txt
Note locations:
EveryFolderFUSION-README.txtRansom message:
notes/FUSION-README.txt
Note locations:
EveryFolderINFECTION-HELP.txtMILIHPEN-INSTRUCT.txtRansom message:
notes/MILIHPEN-INSTRUCT.txt
Note locations:
EveryFolderDERZKO-HELP.txtGANGBANG-NOTE.txtBENTLEY-HELP.txtNEFILIM-HELP.txtKIANO-HELP.txtMANSORY-MESSAGE.txtf1-HELP.txtLEAKS!!!DANGER.txtPUSSY!!!DANGER.txtTechnical Indicators
Associated Executable Files
The following executable files are associated with Nefilim ransomware:
2.exe1.exenelifis.exekinodomino.exeJISFMU5GNZSHLnG.exeweeli.exeFB_21B3.tmp.exesync.badwinnit.binred.ezespt.exetel.exealt.exehappynewyear.exeaes.exescc-2.exemma.exespt(1).binxxx.exesync.bad.exelook (uploaded by Matt Browning (via weblink) Sep 22 2020 11-03-47 UTC).exe
Elastio Can Help You
Don't let Nefilim ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Nefilim ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Nefilim.
Last updated: October 30, 2025
Recent Ransomware
Explore other threats in our database