APT / THREAT GROUP

N3Cr0m0rPh

aliases

Last seen:Mar 17, 2026

Intelligence Profile

An IRC bot written in (obfuscated) Python code. Distributed in attack campaign FreakOut, written by author Freak/Fl0urite and development potentially dating back as far as 2015.

Threat Analysis

N3Cr0m0rPh is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/

→https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/

→https://blog.netlab.360.com/necro/

→https://blog.netlab.360.com/not-really-new-pyhton-ddos-bot-n3cr0m0rph-necromorph/

→https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html

Quick Facts

TypeAPT / Threat Group

Aliases4

Also Known As

Necropy.n3cr0m0rphN3Cr0m0rPhFreakOut

External Intelligence

Malpedia: py.n3cr0m0rph

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search N3Cr0m0rPh