Traveling Spider

Russian Federation


TRAVELING SPIDER is the criminal developer and vendor of several ransomware variants, including Nemty, Nemty X (a.k.a. Nefilim), Karma, and Nokoyawa. With each new ransomware variant, TRAVELING SPIDER retires the previous variant. Additionally, since Karma’s late-2021 release, each of the adversary’s developed ransomware families has operated as a Ransomware-as-a-Service (RaaS). In August 2023, TR...

Community Identifiers



  • hOJZuNsSe5Idmta


  • Hy1wn7ku

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.