View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Nefilim Hackers Publish Oil Firm Data Online and Continue Disruptive Campaign

“Nefilim’s code shares many notable similarities with Nemty 2.5 ransomware"

By CBR Staff Writer

A cyber criminal group known for its Nefilim (Netfilim) ransomware is continuing to target energy companies and has published an array of sensitive data belonging to India’s largest offshore drilling company Aban Offshore this week.

Cybersecurity firm Cyble has confirmed the data breach, which contains business sensitive information relating to the firm and its contractors, as well as more than 250 employee passport details.

Aban Offshore is India’s largest offshore drilling company and has done extensive work with Iranian firms in operating five offshore rigs. The latest information dump comes as a growing number of firms have been targeted and held to ransom by the hackers in recent months.

Trend Micro noted in a security blog: “Nefilim’s code shares many notable similarities with Nemty 2.5 ransomware; the main difference is the fact that Nefilim has done away with the Ransomware-as-a-Service (RaaS) component. It also manages payments via email communication rather than through a Tor payment site.”

The ransomware uses AES-128 encryption to lock a victim’s files. All files are also marked with a ‘Nefilim’ string to the files so if a file is oil.doc it would be marked as oil.doc.nefilim. In order to decrypt these files the victim requires the RSA private key held by the hackers.

Nefilim Operator’s Campaign in Full Swing

The Nefilim ransomware hackers are proving to be a significant threat for companies as they have breached a number of systems and are not hesitant to publish sensitive data online.

Yet it’s not just energy firms that are being targeted as Australian-based logistics behemoth Toll Group was also a victim of the campaign in May which successfully breached a Toll Group server. The logistic firm turned down any attempt to engage with the hackers and pay a fee to restore their system.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Toll Group stated in May that: “After detecting this attack, we shut down our IT systems to mitigate the risk of further infection. Toll has refused from the outset to engage with the attacker’s ransom demands, which is consistent with the advice of cyber security experts and government authorities.”

“Our ongoing investigations have established that the attacker has accessed at least one specific corporate server. This server contains information relating to some past and present Toll employees, and details of commercial agreements with some of our current and former enterprise customers. The server in question is not designed as a repository for customer operational data.”

The hackers subsequently published a cache of the data on the dark web. Toll Groups last public update on the incident was at the end of May in which they noted that they were still in the process of restoring ‘key online systems.’

Ransomware is a serious issue for firms and is getting more sophisticated as just last February the UK’s cyber agency NCSC updated its guidance as it had seen “numerous incidents where ransomware has not only encrypted the original data on-disk, but also connected USB and network storage drives holding data backups.”

So all precautions should be taken to ensure that threat actors don’t get access to networks as the damage could be permanent.

See Also: DWP Wraps Up Mammoth “Job Seeker’s” Mainframe to X86 Migration

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.