--- title: "Threat analysis: N3tw0rm ransomware" description: N3tw0rm ransomware is a sophisticated cyberthreat that’s actively targeting high-value organizations and leaking data publicly if the ransom isn’t paid. Learn how this piece of malware operates, and how Acronis’ cyber protection solutions can keep your data and applications safe. canonical_url: https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Threat analysis: N3tw0rm ransomware On May 2, 2021, сybercriminal group N3tw0rm attacked the computer networks of international clothing retailer H&M in Israel and threatened to release customer data. This was reported by the Israeli magazine Haaretz, which previously reported attacks on at least four Israeli companies and one non-profit organization. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 2 min read Last updated 05 July 2021 ## Summary * Uses targeted attack approach to hack into corporate networks of Israeli companies. * Employs a client-server model for encrypting computers in the target networks * N3tw0rm is supposedly connected with the Iranian operators of the ransomware Pay2Key * The threat actors behind the N3tw0rm have already released 110 GB of data from H&M Israel and 9 GB of data from the shipping company Veritas on their data leak site ## Attack vectors and recent targets On May 2, 2021, сybercriminal group N3tw0rm attacked the computer networks of international clothing retailer H&M in Israel and threatened to release customer data. This was reported by the Israeli magazine Haaretz, which previously reported attacks on at least four Israeli companies and one non-profit organization. Typically, the attackers use a spear-phishing to deliver an email with a malicious attachment or credentials for RDP access that can be bought on the dark web. N3tw0rm set up a data leak site where they threaten to release stolen files if the victim doesn't pay the ransom. The hackers have threatened to release 110 GB of data from H&M Israel, and 9 GB of data from the shipping company Veritas, including customer, account, employee and possibly billing information. According to BleepingComputer, cybercriminals have already published the exfiltrated data that was stolen during the attack on Veritas, suggesting that the ransom demand was not met. Haaretz reports that the attackers demanded a ransom of 3 bitcoin (approximately $120,000 at the time of writing) for deleting Veritas data, and a source from BleepingComputer mentions 4 bitcoin (approximately $160,000). Israeli cybersecurity sources speculate that ransom is not the primary goal of cybercriminals. Instead, they want to undermine and damage Israel's status as a prominent cyber force. The criminals are thus thought to be politically motivated. Experts explain such conclusions by the fact that N3tw0rm is supposedly connected with the Iranian operators of the ransomware Pay2Key, which last year announced the hacking of Israel Aerospace Industries and the Israeli information security company Portnox. But at the moment, N3tw0rm attacks have not been associated with other hacker groups. The hackers recently published information about one more victim from Israel — Ecolog Engineering Ltd., a private consulting and design firm specializing in environmental impact assessments. [[AI1]](https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/#_msocom_1) ## Self-defense N3tw0rm employs a collection of anti-debugging techniques, including string encryption with XOR, checking for the presence of a debugger with Windows API, checking debugging flags, triggering unhandled exceptions, and using a performance counter. If debugging is detected, N3tw0rm shuts down the system. &nbs Hackers use PAExec to deploy and run the ‘slave.exe’ client on all encrypted devices. Encrypted files will have a .n3tw0rm extension. ## Wiping free disk space To prevent restoration of deleted files after encryption, the ransomware uses an unusual technique. It launches a so-called “Free space worker” which creates many temporary files on network drives and fills them with zeros. After all available space has been filled with temp files, the “Free space worker” deletes them. As a result, all free space on network drives is wiped with zeros. ## Ransom note The ransom note contains contact and payment information, and appears as follows: ## Detection by Acronis Acronis’ Active Protection technology uses advanced machine intelligence and behavioral analysis to successfully identify and stop N3tw0rm attacks — as well as any other known or unknown cyberthreat. Backups are protected against tampering, and enable the automatic and rapid restoration of any encrypted files. Some cybersecurity researchers believe that N3tw0rm is a product of Iranian hacker groups, and designed to attack vulnerable systems. This ransomware has so far been used exclusively against Israeli companies and users. ## IoCs SHA256: 8c6fd14084820ec528749300222097d21197659535aaa50cdcc75831f73546c1 [](https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/)[[AI1]](https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/#_msoanchor_1)Can be removed [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/lockbit-ransomware/) [Threat analysis: LockBit ransomware](https://www.acronis.com/en/blog/posts/lockbit-ransomware/) [Next post](https://www.acronis.com/en/blog/posts/babuk-ransomware/) [Threat analysis: Babuk ransomware](https://www.acronis.com/en/blog/posts/babuk-ransomware/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read