Loading threat actor…
farnetwork is a cybercriminal persona associated with the administration, development, management, marketing, and recruitment activities of multiple ransomware operations. The persona has been linked to Volodymyr Viktorovich Tymoshchuk, a Ukrainian national charged by U.S. authorities in connection with several major ransomware schemes. farnetwork has been associated with LockerGoga, MegaCortex, and Nefilim, and has also been linked to JSWORM, Karma, Nemty, and Nokoyawa Ransomware-as-a-Service operations. Reporting describes the persona as both a developer and manager of ransomware platforms as well as an active recruiter on criminal forums, including offering affiliates revenue-sharing arrangements. The actor’s operations have been tied to attacks against more than 250 organizations in the United States and hundreds more globally. The activity is consistent with financially motivated ransomware operations involving platform administration, affiliate enablement, and broad victimization. The available information supports a role spanning ransomware development, operational management, and ecosystem support rather than a single isolated intrusion set. Known aliases associated with the same individual include deadforz, Boba, and msfv.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.