Cyber Threat Actor: nheqminer

The threat actor known by the alias nheqminer has been observed operating from Russia. Public reporting links this alias to a financially motivated intrusion that targeted a major Russian real estate firm in February 2019. The attack focused on a single organization within the real estate sector, indicating a narrow geographic focus on Russian entities. The actor’s objectives, as inferred from the observed payload, were to generate immediate monetary gain through ransomware encryption, covert cryptocurrency mining, and credential theft for further exploitation. No evidence of espionage or disruptive intent was presented in the available material; the described activities centered on profit‑oriented outcomes. The incident highlighted a blend of extortion and resource‑abuse tactics rather than a purely destructive or intelligence‑gathering agenda.

The actor’s typical tactics began with a phishing email delivering a malicious ZIP file that contained heavily obfuscated JavaScript masquerading as legitimate order details. This JavaScript served as a multi‑stage loader that deployed three distinct components: the Troldesh ransomware, which appended the “.crypted000007” extension to files and altered desktop wallpapers; a cryptocurrency miner that produced approximately 4.89 ZCash for the attackers; and a Trojan‑Heur module enabling credential harvesting, remote system control, and brute‑force attempts against WordPress sites. The use of obfuscated scripting and a staged payload reflects a tooling style aimed at evading initial detection while maintaining persistence. Attribution to any state sponsor or criminal consortium has not been established in public sources; the activity is described as indicative of possible botnet misuse or profit‑maximizing tactics rather than state‑sponsored espionage. The February 2019 real‑estate intrusion remains the sole publicly reported operation associated with the nheqminer alias.