Loading threat actor…
NetWalker, also known as Mailto and Koko, is a financially motivated ransomware operation that emerged in 2019 and evolved into a major ransomware-as-a-service ecosystem targeting organizations worldwide. The operation is known for encrypting victim data and later adopting double-extortion tactics by stealing data before encryption and threatening public release through dedicated leak infrastructure. NetWalker affiliates have targeted a wide range of organizations, including hospitals, law enforcement agencies, emergency services, municipalities, school districts, colleges, universities, and private companies. NetWalker operators and affiliates gained access through multiple intrusion vectors, including exposed or insecure RDP services and exploitation of public-facing enterprise software such as Oracle WebLogic, Apache Tomcat, Pulse Secure VPN vulnerable to CVE-2019-11510, and Telerik UI vulnerable to CVE-2019-18935. Reported tradecraft also includes deletion of shadow copies, code injection into explorer.exe, persistence via autorun mechanisms, and post-compromise cleanup to reduce forensic traces. Later variants added capabilities such as process unlocking through the Restart Manager API and PowerShell-based builds. The operation shifted over time from email-based ransom communications to Tor-based payment portals and leak sites, reflecting a more mature extortion model. By 2020, NetWalker was associated with large-enterprise targeting and had reportedly generated substantial criminal revenue. Law-enforcement action in 2021 disrupted parts of its infrastructure, and subsequent prosecutions of affiliates in Canada, Romania, and the United States further tied the operation to an affiliate-based criminal model. NetWalker is widely recognized as one of the prominent ransomware families of the 2019-2021 period.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ukrainian SBU special operations center using MICH 2000 long-range strike drones against Russian military and infrastructure targets, including Engels-2 air base and other deep-strike targets inside Russia.
Mentioned as a possible rebrand or successor with similarities to Netwalker, but not established conclusively in the content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.