Ransomware Research

Nefilim Ransomware

Nefilim is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on March 1, 2020, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Nefilim, Nefilim Doxware, Nephilim, Offwhite, Sigareta, Telegram, Nef1lim, Mefilin, Trapget, Merin, Fusion, Infection, Milihpen, Derzko, Gangbang, Kiano, Mansory.

Quick Facts

Ransomware Family
Nefilim
First Seen
March 1, 2020
Known Aliases
NefilimNefilim DoxwareNephilimOffwhiteSigaretaTelegramNef1limMefilinTrapgetMerinFusionInfectionMilihpenDerzkoGangbangKianoMansory

How Nefilim Ransomware Works

File Encryption Patterns

Nefilim modifies encrypted files using specific patterns to mark them as encrypted:

File extensions added after encryption:

..NEFILIM..NEPHILIM..OFFWHITE..SIGARETA..TELEGRAM..NEF1LIM..MEFILIN..TRAPGET..MERIN..FUSION..INFECTION..MILIHPEN..DERZKO..GANGBANG..BENTLEY..KIANO..MANSORY..f1..LEAKS..PUSSY

Ransom Note and Payment Demands

After encrypting files, Nefilim displays ransom notes demanding payment for file recovery:

fileNEFILIM-DECRYPT.txt

Ransom message:

notes/NEFILIM-DECRYPT.txt

Note locations:

EveryFolder
fileNEPHILIM-DECRYPT.txt

Ransom message:

notes/NEPHILIM-DECRYPT.txt

Note locations:

EveryFolder
fileOFFWHITE-MANUAL.txt

Ransom message:

notes/OFFWHITE-MANUAL.txt

Note locations:

EveryFolder
fileSIGARETA-RESTORE.txt

Ransom message:

notes/SIGARETA-RESTORE.txt

Note locations:

EveryFolder
fileTELEGRAM-RECOVER.txt

Ransom message:

notes/TELEGRAM-RECOVER.txt

Note locations:

EveryFolder
fileNEF1LIM-DECRYPT.txt

Ransom message:

notes/NEF1LIM-DECRYPT.txt

Note locations:

EveryFolder
fileMEFILIN-README.txt
fileTRAPGET-INSTRUCTION.txt

Ransom message:

notes/TRAPGET-INSTRUCTION.txt

Note locations:

EveryFolder
fileMERIN-DECRYPTING.txt

Ransom message:

notes/MERIN-DECRYPTING.txt

Note locations:

EveryFolder
fileFUSION-README.txt

Ransom message:

notes/FUSION-README.txt

Note locations:

EveryFolder
fileINFECTION-HELP.txt
fileMILIHPEN-INSTRUCT.txt

Ransom message:

notes/MILIHPEN-INSTRUCT.txt

Note locations:

EveryFolder
fileDERZKO-HELP.txt
fileGANGBANG-NOTE.txt
fileBENTLEY-HELP.txt
fileNEFILIM-HELP.txt
fileKIANO-HELP.txt
fileMANSORY-MESSAGE.txt
filef1-HELP.txt
fileLEAKS!!!DANGER.txt
filePUSSY!!!DANGER.txt

Technical Indicators

Associated Executable Files

The following executable files are associated with Nefilim ransomware:

  • 2.exe
  • 1.exe
  • nelifis.exe
  • kinodomino.exe
  • JISFMU5GNZSHLnG.exe
  • weeli.exe
  • FB_21B3.tmp.exe
  • sync.bad
  • winnit.bin
  • red.eze
  • spt.exe
  • tel.exe
  • alt.exe
  • happynewyear.exe
  • aes.exe
  • scc-2.exe
  • mma.exe
  • spt(1).bin
  • xxx.exe
  • sync.bad.exe
  • look (uploaded by Matt Browning (via weblink) Sep 22 2020 11-03-47 UTC).exe

Elastio Can Help You

Don't let Nefilim ransomware take over your data

Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.

About This Analysis

This Nefilim ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Nefilim.

Last updated: July 30, 2025

Nefilim Ransomware - Detectable by Elastio