Ransomware Group
Nokoyawa
Nokoyawa is a double-extortion ransomware group that launched a RaaS program in 2022 (operated by threat actor "farnetwork"), primarily targeting businesses in South America across healthcare, financial services, government, and manufacturing, gaining significant attention in 2023 for exploiting a Windows CLFS zero-day (CVE-2023-28252).
Known victims36
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- AdFind
- SoftPerfect NetScan
Exfiltration
- FileZilla
LOLBAS
- PsExec
Offsec
- Cobalt Strike
RMM-Tools
- AnyDesk
Known infrastructure
The following Tor hidden services have been associated with this group:
NOKOYAWA Leaksnoko65rmtaiqyt2cw2h4jrxe3u56t2k7ov3nd22hoji4c5vnfib2i4yd.onionNOKOYAWA LeaksWall of Shame
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Nokoyawa’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request