Loading threat actor…
N3TW0RM is a ransomware threat actor first observed conducting a wave of attacks against organizations in Israel in 2021. Reported victims included multiple Israeli companies and at least one nonprofit organization. The actor operated a leak site and used stolen data to pressure victims, indicating extortion activity in addition to file encryption. The group has been associated with relatively low ransom demands compared with many enterprise ransomware operations. Its campaigns have been notable for an unusual internal client-server encryption architecture: operators reportedly install a server-side component inside the victim environment, then use administrative deployment tooling to push client encryptors to selected systems. The client component communicates with the internal server to exchange encryption material and receive instructions to begin encryption. This design reduces dependence on external command-and-control infrastructure and may complicate tracing while supporting coordinated encryption across the victim network. Researchers observed similarities between N3TW0RM activity and earlier Pay2Key attacks against Israeli targets. Pay2Key has previously been linked to the Iranian threat actor Fox Kitten, and some reporting has suggested N3TW0RM may fit the broader pattern of disruptive, Iran-linked ransomware activity targeting Israeli interests. However, no confirmed attribution of N3TW0RM to a specific threat actor or government has been established. Its operations nevertheless align with ransomware-based disruption and extortion directed at Israeli organizations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Newly identified Iran-linked ransomware threat actor associated with disruptive attacks targeting Israel and linked to the 2020 Pay2Key attacks.
Conducting ransomware attacks against Israeli companies and a nonprofit organization, using data theft and leak-site extortion, and deploying ransomware via a client-server encryption model.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.