Traveling Spider

Russian Federation


TRAVELING SPIDER is the criminal developer and vendor of the ransomware variants Nemty, Nemty X (a.k.a. Nefilim), Karma, and Nokoyawa. The criminal group initially offered Nemty in an affiliate program, openly advertised on a Russian-language forum, using the monikers jsworm and jingo. However, in mid-April 2020, TRAVELING SPIDER advertised they were moving to a private operation, retiring Nemty i...

Community Identifiers



  • BRZusk8LYvOKq1U


  • Ar9LbZKp

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.