NetWalker

NetWalker, also known as Mailto and Koko, was a financially motivated ransomware-as-a-service operation active from 2019 until major law-enforcement disruption in early 2021. It evolved from conventional file-encryption ransomware into a double-extortion enterprise that stole data before encryption and used a leak site to pressure victims. The operation recruited affiliates on Russian-language cybercrime forums, provided continuously updated ransomware builds, administrative panels, automated payment infrastructure, and a victim-shaming blog, and offered unusually high revenue shares to intrusion partners. Affiliates were tasked with gaining access to victim environments and deploying the ransomware, while the core operators maintained the malware and extortion platform. NetWalker targeted organizations worldwide, with a majority of known victims in the United States. Victim sectors included government entities, municipalities, hospitals, law enforcement, emergency services, school districts, colleges, universities, and private companies. Healthcare organizations were specifically targeted during the COVID-19 period. The group also hit large enterprises and critical business operations, including universities and energy-sector organizations. Observed initial access and intrusion methods included exploitation of exposed remote access services and internet-facing enterprise software, including Pulse Secure VPN, Oracle WebLogic, Apache Tomcat, and Telerik UI, as well as insecure RDP configurations. NetWalker operations also used legitimate remote-access tools, custom PowerShell scripts, public-code-repository tooling, and legitimate security-product uninstallers to disable defenses. Reported post-compromise behavior included privilege escalation, antivirus evasion, encryption of mapped drives and shared network resources, deletion of shadow copies, and use of process injection into explorer.exe for execution and cleanup. The malware family used Salsa20 encryption and later shifted from email-based ransom communications to Tor-based payment portals. NetWalker operated a leak site and used stolen data as leverage alongside encryption, making it a prominent early adopter of double extortion among major ransomware groups. Its affiliate program prohibited targeting Russia and other Commonwealth of Independent States countries, a pattern commonly associated with Russian-speaking cybercriminal ecosystems. The operation generated tens of millions of dollars in ransom payments and was linked to hundreds of victims across dozens of countries before U.S. and Bulgarian authorities seized its leak-site infrastructure. Known affiliates and associated actors were later prosecuted in Canada and the United States, and reporting has suggested some former NetWalker affiliates later migrated into other ransomware ecosystems, including Conti.