netwalker
Intelligence Profile
NetWalker ransomware group operates by the threat actor known as "CIRCUS SPIDER". The NetWalker ransomware was discovered in 2019. The group mainly targeting the Asia Pacific region but can attack globally. The group uses common attacking tools like Mimikatz and other legitimate tools (LOLBINS) like PSTools, AnyDesk, TeamViewer, NLBrute, and more. The group knowing by targeting the healthcare sector. Finally, in January 2021, Netwalker was takedown by the authorities, the police have confiscated hundreds of thousands of dollars in ransom payments collected by the Netwalker group, and they seized servers and disrupted the infrastructure and the darknet websites of the Netwalker ransomware group.
Intelligence Assessment
NetWalker is a ransomware operation attributed to the threat actor known as
NetWalker has tracked 26 victims in total, with no new victims in the last 90 days. Their top targeted sectors include Healthcare, Manufacturing, Technology, Energy, and Education, with primary victim countries being US, CA, AU, AR, and AT.
The group uses common attacking tools like Mimikatz and other legitimate tools (LOLBINS) like PSTools, AnyDesk, TeamViewer, and NLBrute.
NetWalker's last attack was on 2020-12-12. The group was taken down by authorities in January 2021, and there has been no activity since. This group appears dormant.
Threat Analysis
netwalker is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like netwalker prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (26)
CTIWATCH tracks 26 organizations claimed as victims by netwalker on its data leak site, with attack dates, sectors and countries.
View full victims list →