Loading malware…
Nokoyawa is a Windows ransomware family that emerged in early 2022 and is associated with double-extortion operations in which attackers steal data before encrypting systems and demanding payment. It is widely assessed as part of the Nemty/Karma lineage, although some reporting has also noted operational overlap with Hive and other ransomware ecosystems, likely reflecting shared affiliates or infrastructure rather than a direct code relationship in all cases. The malware has been linked to hands-on-keyboard intrusions conducted by ransomware affiliates and has appeared in campaigns culminating after earlier-stage infections involving commodity malware and Cobalt Strike.
Nokoyawa targets 64-bit Windows systems and has evolved through multiple versions, including variants commonly labeled 1.0, 1.1, 2.0, and 2.1, with the latter also referred to as Nevada. Earlier variants were written in C or C++, while later versions were rewritten in Rust. Across versions, Nokoyawa uses elliptic-curve cryptography combined with Salsa20 for file encryption, with later variants moving from SECT233R1 to Curve25519/X25519-based key exchange. The malware supports configurable execution through command-line parameters and, in some versions, a Base64-encoded JSON configuration that allows operators or affiliates to customize ransom-note content, encrypted-file extensions, skip lists, network-encryption behavior, hidden-drive handling, and shadow-copy deletion.
The ransomware is designed for rapid enterprise-wide impact. Observed capabilities include encryption of local files, optional encryption of network shares, deletion of Windows Shadow Copies, exclusion logic for selected directories and file types, and in some variants self-deletion after execution. One analyzed variant supports rebooting a host into Safe Mode before encryption. Nokoyawa has also been observed using locale-based checks to avoid execution on systems associated with former CIS countries. In intrusion reporting, operators deployed the ransomware after credential theft, Active Directory reconnaissance, lateral movement, and staging across multiple hosts, including domain controllers and servers.
Nokoyawa has been associated with exploitation chains involving Windows Common Log File System privilege-escalation vulnerabilities, including multiple CLFS zero-days used after initial compromise to elevate privileges before ransomware deployment. It has also been observed at the end of phishing-led intrusions in which initial access malware established persistence and command-and-control before operators moved laterally and launched the encryptor. Reported victimology includes organizations in South America, especially Argentina, as well as small and medium businesses in the Middle East, North America, and Asia. Repeated overlap in leak-site victim postings with other ransomware brands has also been noted.
The family is notable both for its technical evolution and for its place in the broader ransomware-as-a-service ecosystem, where affiliates, access brokers, and shared tooling blur boundaries between nominally distinct ransomware brands. Nokoyawa remains best characterized as a Windows ransomware family used in human-operated intrusions that combine data theft, lateral movement, and file encryption for extortion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Like CVE-2023-28252, three of these earlier vulnerabilities used to deliver Nokoyawa (CVE-2022-24521, CVE-2022-37969, and CVE-2023-23376) were zero-days detected in the wild. | ...a series of attempts to exploit similar vulnerabilities intended to culminate in the deployment of the Nokoyawa strain of ransomware.
Like CVE-2023-28252, three of these earlier vulnerabilities used to deliver Nokoyawa (CVE-2022-24521, CVE-2022-37969, and CVE-2023-23376) were zero-days detected in the wild. | ...a series of attempts to exploit similar vulnerabilities intended to culminate in the deployment of the Nokoyawa strain of ransomware.
Microsoft disclosed a zero-day vulnerability in the Windows Common Log File System (CLFS), which cybercriminals are actively exploiting to deploy Nokoyawa ransomware payloads. The vulnerability, tracked as CVE-2023-28252 (CVSS: 7.8), is a Privilege Escalation vulnerability in the Windows Common Log File System Driver; it impacts all supported Windows servers and client versions. | Microsoft disclosed a zero-day vulnerability in the Windows Common Log File System (CLFS), which cybercriminals are actively exploiting to deploy Nokoyawa ransomware payloads.
Like CVE-2023-28252, three of these earlier vulnerabilities used to deliver Nokoyawa (CVE-2022-24521, CVE-2022-37969, and CVE-2023-23376) were zero-days detected in the wild. | ...a series of attempts to exploit similar vulnerabilities intended to culminate in the deployment of the Nokoyawa strain of ransomware.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In May 2022, DEV-0237 started to routinely deploy Nokoyawa, a payload that we observed the group previously experimenting with when they weren’t using Hive.
Five minutes after transferring the files to hosts in the domain, the Nokoyawa ransomware binary was executed on a domain controller... The time to ransomware (TTR) was just over 12 hours from the initial infection.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Microsoft disclosed a zero-day vulnerability in the Windows Common Log File System (CLFS), which cybercriminals are actively exploiting to deploy Nokoyawa ransomware payloads. The vulnerability, tracked as CVE-2023-28252 ... is a Privilege Escalation vulnerability in the Windows Common Log File System Driver ... Successful exploitation enables threat actors to gain SYSTEM privileges
In addition, Nokoyawa 1.1 is the only variant that obfuscates the Windows API functions that are called during runtime by resolving each name via CRC32 hash.
In order to reduce the risk of law enforcement actions, Both Nokoyawa 2.0 and Nevada check whether the infected system is located in a former Commonwealth of Independent States (CIS) country. The former calls the Windows API GetSystemDefaultLCID... and the latter calls GetUserDefaultUILanguage... to determine the system's locale and language, respectively.
The configuration parameter is a Base64 encoded JSON object that has the following keys and values shown in Table 2... ENCRYPT_NETWORK Encrypt network shares
In order to reduce the risk of law enforcement actions, Both Nokoyawa 2.0 and Nevada check whether the infected system is located in a former Commonwealth of Independent States (CIS) country. The former calls the Windows API GetSystemDefaultLCID... and the latter calls GetUserDefaultUILanguage... to determine the system's locale and language, respectively.
Both Nokoyawa 2.0 and Nevada check whether the infected system is located in a former Commonwealth of Independent States (CIS) country. The former calls the Windows API GetSystemDefaultLCID for language IDs ... and the latter calls GetUserDefaultUILanguage ... to determine the system's locale and language, respectively.
After exploitation, attackers must still establish command and control (C2) communications before finally delivering and deploying the Nokoyawa strain of ransomware. The report provides additional indicators of compromise (IoCs) related to these and other stages of the campaign, including the Cobalt Strike Beacon domains used for C2.
Threat actors deploying Nokoyawa ransomware are known to employ the double extortion technique, where data is exfiltrated prior to ransomware deployment | Microsoft disclosed a zero-day vulnerability in the Windows Common Log File System (CLFS), which cybercriminals are actively exploiting to deploy Nokoyawa ransomware payloads.
There are a few commonalities between all Nokoyawa variants such as being compiled only for 64-bit versions of Windows and using a relatively obscure method to delete Windows Shadow Copies. The latter entails calling the function DeviceIoControl ... with the undocumented control code parameter IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE (0x53C028) with a maximum size of 1, which causes Windows to delete all shadow copies as a result.
Nokoyawa 1.1 also has a --safe-mode command-line option to reboot the system into Windows safe mode prior to file encryption to maximize the number of files that can be encrypted by loading the minimal set of applications, and therefore, minimize the number of open file handles that may interfere with encryption.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family assessed as an evolution of the Nemty strain Karma. It encrypts local files and optionally network shares, excludes certain folders and extensions, uses dynamically loaded bcrypt.dll with BCryptGenRandom to seed an ephemeral Sect233r1 key pair, derives a shared Salsa20 key for file encryption, appends its ransomware extension, and drops a ransom note threatening data leakage.
Named ransomware operation referenced in connection with aliases linked to the seller of INC source code.
Ransomware payload delivered after exploitation of CLFS privilege-escalation vulnerabilities; the campaign discussed was intended to culminate in Nokoyawa deployment.
Referenced as a historical RaaS/ransomware operation with TTP overlap to INC Ransom (no additional details provided).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.