Nokoyawa — Ransomware Profile
Nokoyawa ransomware exploited a Windows zero-day CLFS vulnerability (CVE-2023-28252) and targeted small-to-medium businesses globally.Also tracked as
farnetwork, Nevada (Nokoyawa variant), JSWorm lineage
Tools & malware
- AdFind reconnaissance tool
- AnyDesk remote-access tool
- Cobalt Strike post-exploitation framework
- FileZilla exfiltration tool
- Nevada ransomware (Nokoyawa variant) ransomware
- Nokoyawa (ransomware encryptor) ransomware
- PipeMagic modular backdoor
- PsExec lateral-movement tool
- SoftPerfect NetScan network scanner
Vendor research
- Nokoyawa ransomware attacks with Windows zero-day Kaspersky (Securelist)
- Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware Group-IB
- Nokoyawa Ransomware: Rust or Bust Zscaler ThreatLabz
- Nevada Ransomware: Yet Another Nokoyawa Variant Zscaler ThreatLabz
- Nokoyawa Ransomware: In-Depth Analysis, Detection, and Mitigation SentinelOne
- Windows zero-day vulnerability exploited in ransomware attacks BleepingComputer