Nemty

Nemty is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It was developed by a cybercriminal group known as farnetwork, which has been active since 2019. Farnetwork has been involved in several ransomware projects, including JSWORM, Nefilim, Karma, and Nemty. These malicious programs have the ability to disrupt operations, steal personal information, or hold data hostage for ransom. The group has been linked to various Ransomware-as-a-Service (RaaS) schemes between 2019 and 2021. In 2022, farnetwork launched their own RaaS program based on Nokoyawa ransomware, an evolution of the Nemty and Karma ransomware families. This move was expected due to farnetwork's prior experience deploying both Nemty and Karma strains. Throughout its cybercriminal career, farnetwork has used multiple handles, such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit, and has helped develop ransomware and manage the RaaS programs before launching their own. During its tenure, farnetwork managed to secure significant ransom payments from its victims. In 2019, it was reported that the RaaS project they managed — believed to be Nemty — received ransom payments averaging $1 million per victim initially, which later fell to about $600,000. For successful attacks carried out using Nokoyawa’s ransomware, affiliates received 65% of the ransom amount, with 20% going to the botnet owner and 15% to the developer.