NokoyawaMalware
Last reported 8 months ago, by Group-IB3 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“…dowSyndicate infrastructure, the following groups were not seen as a part of currently analyzed clusters: LockBit, Cicada3301, Quantum, Nokoyawa, Cactus and Play.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“…e gathering, Group-IB’s Threat Intelligence team attempted to infiltrate a private Ransomware-as-a-Service (RaaS) program that uses the Nokoyawa ransomware strain.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“We can, with a strong degree of confidence, attribute ShadowSyndicate to Quantum ransomware activity in September 2022, Nokoyawa ransomware activity in October 2022, November 2022, and March 2023, as well as to ALPHV activity in February 2023.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- anbush[.]comin 1 report
- mysqlserver[.]orgin 1 report
- ipulsecloud[.]comin 1 report
- esoftwareupdates[.]comin 1 report
- cmdatabase[.]comin 1 report
- maximumservers[.]netin 1 report
- avdev[.]netin 1 report
- devcloudpro[.]comin 1 report
- uranustechsolution[.]comin 1 report
- qw.sveexec[.]comin 1 report
- situotech[.]comin 1 report
- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 194.165.16[.]64in 1 report
- 46.161.27[.]151in 1 report
- 193.142.30[.]37in 1 report
- 193.142.30[.]205in 1 report
- 81.19.135[.]229in 1 report
- 194.165.16[.]53in 1 report
- 5.188.87[.]47in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.