Threat Actor Profile
Low Cybercriminal
Description

N3tw0rm ransomware group is linked to Iran by many security researchers especially for the fact that the group targeting only Israeli companies. Like other ransomware groups, N3tw0rm has a data leak site in the darknet. Due to the low ransom price the group requested and lack of response to negotiations, some security researchers believe that the N3tw0rm group's main goal is to be used for sowing chaos for Israeli interests and not for profit.

Confidence Score
100%
Tags
ransomware ransomware.live
First Seen

Unknown

Last Updated

Unknown

Active Status
Active
Created

April 29, 2026

Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel
STIX Data
{'added_date': None,
 'client': '2003264@sit.singaporetech.edu.sg',
 'description': 'N3tw0rm ransomware group is linked to Iran by many security '
                'researchers especially for the fact that the group targeting '
                'only Israeli companies. Like other ransomware groups, N3tw0rm '
                'has a data leak site in the darknet. Due to the low ransom '
                'price the group requested and lack of response to '
                'negotiations, some security researchers believe that the '
                "N3tw0rm group's main goal is to be used for sowing chaos for "
                'Israeli interests and not for profit.\n',
 'firstseen': None,
 'group': 'n3tworm',
 'has_negotiations': False,
 'has_ransomnote': False,
 'lastseen': None,
 'locations': [{'available': False,
                'fqdn': 'n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion',
                'slug': 'http://n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion',
                'title': '',
                'type': 'DLS'}],
 'negotiation_count': 0,
 'ransomnotes_count': 0,
 'tiaras_metadata': {'has_negotiations': False,
                     'has_ransomnote': False,
                     'locations': [{'available': False,
                                    'fqdn': 'n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion',
                                    'slug': 'http://n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion',
                                    'title': '',
                                    'type': 'DLS'}],
                     'negotiation_count': 0,
                     'ransomnotes_count': 0,
                     'ransomware_live_group': 'n3tworm',
                     'tools': {},
                     'url': 'https://www.ransomware.live/group/n3tworm',
                     'victims': 0,
                     'vulnerabilities': []},
 'tiaras_source': 'ransomware.live',
 'tools': {},
 'ttps': [],
 'url': 'https://www.ransomware.live/group/n3tworm',
 'victims': 0,
 'vulnerabilities': []}
Quick Actions