Cyber Threat Actor: Netfilm

Netfilm is an alias used by a threat actor that has been publicly referenced in cybersecurity reporting. The actor is located in Canada. Open‑source descriptions label Netfilm as a ransomware gang. No further details about its size, structure, or internal organization have been disclosed in the sources examined. The name appears in connection with a specific incident involving a Canadian firm.

In November 2020, Colliers International Group, a Toronto‑based provider of commercial real estate services, reported experiencing a cyberattack. According to the reporting, the intrusion was potentially linked to the Netfilm ransomware gang. The attackers allegedly exfiltrated internal files and posted proof of the data theft on a dark web leak site. Colliers International acknowledged that a security incident had occurred. However, the organization declined to confirm whether ransomware was deployed or to validate the attackers’ claims about the compromised data. The incident was covered by a data breach news outlet, which noted the lack of confirmation from the victim. No additional technical details about the malware or infection vector were provided in the source.

Beyond the Colliers International case, no other publicly attributed operations or campaigns have been identified for Netfilm in the material reviewed. Consequently, any statements about its typical target sectors, geographic focus, strategic objectives, or preferred tactics remain unsupported by the available evidence. The limited information prevents assessment of whether the actor acts independently or as part of a larger criminal consortium. Researchers should treat the Netfilm designation as a provisional label tied to the single reported incident. Continued monitoring of threat intelligence feeds may reveal further activity linked to this alias. Until more concrete data emerge, the profile of Netfilm remains based solely on the confirmed facts outlined above.