Open Nav
Sign Up

N3TW0RM Ransomware IOCS

Oran Cohen

May 5, 2021

Updated: 15:00 GMT 09/05/21

A new ransomware attack group called N3tw0rm is claiming to have penetrated the network of several Israeli companies included Veritas, an international shipping and logistics company, Ecolog, an infrastructure engineering company, and Israel’s branch of clothing retailer H&M. In a departure from previous behavior, a source familiar with the matter stated that after encryption the threat actors did not send H&M a ransom demand since their aim is to embarrass H&M.

N3tw0rm ransomware origins

There is speculation that this N3tw0rm group is associated with Iran. If confirmed, the group will be operating hot on the heels of Pay2Key, a group that attacked numerous companies including Intel, Portnox and IAI back in December 2020. OP Innovate was at the forefront of Israel’s response to Pay2Key and verifies that this new attack exhibits similarities in the MO of the Pay2Key attack. It may be timed to coincide with Israel’s upcoming Jerusalem Day. OP Innovate has put together a list of IOCs (indicators of compromise) we have been able to identify from our investigations so far:

IndicatorsTagsComments
8080PortPort between internal secondary and internal primary
C:\Windows\Temp\n3tw0rm\Slave.exe Path, File 
8C6FD14084820EC528749300222097D21197659535AAA50CDCC75831F73546C1 SHA256 
4AC7B7A9992CFD83912DC912105D615CMD5 
C:\Windows\Temp\n3tw0rm\FreeSpaceWorker.exePath, File 
B1B8DBA2291604B968482D65B6B53142B1BF50A8D5B7CD0D652E9C6BF6A3E1BBSHA256 
paexec-[#####]-[computername].exeFileTool in use (# are for random numbers)
85.203.15.19IP AddressC&C – Express VPN
85.203.15.35IP AddressC&C – Express VPN
s.exeFileServer
pp64.exeFilePypykatz
078667339385F3B77AEA2023C8FF9DB373841741SHA256Pypykatz hash

Protect yourselves from ransomware gangs

For more information on how OP Innovate‘s cybersecurity expertise can help protect your company’s vital assets from falling into the wrong hands, contact Shay Pinsker at shay@op-c.net.

Written by Oran Cohen, Chief Security Officer at OP innovate

Resources highlights

High-Severity WordPress Vulnerability in Forminator Plugin (CVE-2025-6463)

A critical vulnerability in the Forminator plugin, one of the most popular form-building plugins in Wordpress, allows unauthenticated attackers to delete arbitrary files on the…

Read more >

CVE-2025-6463

CVE-2025-6554: Chrome V8 Zero-Day Exploited in the Wild

On June 30, 2025, Google issued an emergency patch for a critical zero-day vulnerability in its Chrome browser, tracked as CVE-2025-6554. The flaw resides in…

Read more >

CVE-2025-6554

Critical Cisco ISE Vulnerabilities Lead to Unauthenticated RCE (CVE-2025-20281 & CVE-2025-20282)

On June 25, 2025, Cisco disclosed and patched two critical remote code execution (RCE) vulnerabilities: CVE-2025-20281 and CVE-2025-20282, affecting its widely deployed Identity Services Engine…

Read more >

CVE-2025-20281 & CVE-2025-20282

Critical Vulnerability in MegaRAC BMC Added to CISA’s KEV: CVE-2024-54085

On June 25, 2025, CISA added CVE‑2024‑54085, a critical authentication bypass vulnerability in the MegaRAC SPx Baseboard Management Controller (BMC) firmware, to its Known Exploited…

Read more >

CVE-2024-54085

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding a sophisticated malware campaign dubbed “UMBRELLA…

Read more >

umbrella stand fortinet

CVE-2025-49144: Privilege Escalation in Notepad++ Installer Enables Full SYSTEM Access

A critical local privilege escalation vulnerability in the Notepad++ v8.8.1 installer allows attackers to escalate to NT AUTHORITY\SYSTEM using binary planting techniques. Tracked as CVE-2025-49144,…

Read more >

CVE-2025-49144
Under Cyber Attack?

Fill out the form and we will contact you immediately.