Nemty ransomware

Nemty is a family of Windows ransomware that surfaced in late August 2019 and was rented to affiliates through a web panel until about April 2020. Early builds added a plain Nemty suffix; within days the suffix was changed to carry a per-victim ID, so the exact extension and note name differ by build and by victim. The operators reportedly broke in over exposed Remote Desktop, removed shadow copies, and sent victims to a Tor portal where they uploaded a configuration file to pay. Versions ran from 1.0 up to the 2.x line, and the encryption changed several times along the way, which is why free recovery depends on the version: a free tool on No More Ransom handles builds up to 1.6, and versions 2.2 and 2.3 only for most Word, Excel and PowerPoint files. Keep the note and a few encrypted files to confirm the version before acting. Nefilim, which has its own page, reuses Nemty's file-encryption code and is widely seen as its successor. Member page: NEMTY REVENGE 2.0.

Sources: BleepingComputer, Tesorion, Tesorion, Tesorion

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-30.

Scope: Tesorion's free decryptor on No More Ransom covers Nemty up to version 1.6 (many but not all files) and versions 2.2 and 2.3 for most docx, xlsx and pptx files only. Later versions, including NEMTY REVENGE 2.0, are not shown to be covered.

Sources: Tesorion