Netflim
Netflim is a ransomware group with a financial motive, tracked by Brandefense. It targets the Construction and Real Estate sector in Canada.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Netflim.
Netflim is a Ransomware group primarily motivated by financial-gain. The group mainly targets large organizations with revenues exceeding $200 million across financial services, manufacturing, transportation, oil and gas, and energy sectors in North America, South America, Europe, Asia, and Oceania, and is assessed to operate with advanced sophistication. It is commonly associated with the NEMTY ransomware lineage and employs AES-128 and RSA-2048 encryption, Cobalt Strike, Mimikatz, LaZagne, and PsExec. Netflim is known for leveraging exposed Remote Desktop Protocol (RDP) and Citrix gateway vulnerabilities for initial access, utilizing double-extortion tactics with long-term data leak hosting, and its reported pledge not to target healthcare and nonprofit organizations during the COVID-19 pandemic.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.