Nokoyawa

Nokoyawa is a Windows ransomware family that emerged in early 2022 and is associated with double-extortion operations in which attackers steal data before encrypting systems and demanding payment. It is widely assessed as part of the Nemty/Karma lineage, although some reporting has also noted operational overlap with Hive and other ransomware ecosystems, likely reflecting shared affiliates or infrastructure rather than a direct code relationship in all cases. Nokoyawa has also been linked in reporting to operators and personas associated with broader ransomware-as-a-service activity, including actors tied to Nemty, Karma, JSWORM, and related criminal operations.

Nokoyawa targets 64-bit Windows systems and has evolved through multiple versions, including variants referred to as 1.0, 1.1, 2.0, and 2.1, with the latter also called Nevada. Early variants were written in C or C++, while later versions were rewritten in Rust. Across versions, Nokoyawa uses elliptic-curve cryptography combined with Salsa20 for file encryption, with later variants moving from SECT233R1-based key exchange to Curve25519/X25519. The malware supports configurable execution through command-line parameters and, in some versions, a Base64-encoded JSON configuration that allows operators or affiliates to customize ransom-note content, encrypted-file extensions, skip lists, network-encryption behavior, shadow-copy deletion, and hidden-drive handling.

The ransomware is designed for fast, large-scale enterprise impact. It supports encryption of local files, directories, hidden drives, and network resources, and some variants partially encrypt large files to accelerate execution. Nokoyawa commonly appends metadata to encrypted files to support decryption workflows. Several variants delete Windows Shadow Copies using an uncommon DeviceIoControl-based technique, and some versions include additional operational features such as rebooting into Safe Mode before encryption, self-deletion after execution, API obfuscation, and locale-based exclusion logic intended to avoid systems in former CIS countries.

Observed Nokoyawa intrusions are human-operated and typically involve substantial post-compromise activity before encryption. Reported campaigns have used commodity and criminal tooling such as IcedID, Cobalt Strike, Mimikatz, AdFind, SessionGopher, PsExec, WMIC, PowerShell, GMER, PC Hunter, and network-scanning utilities. Attackers have performed credential theft, Active Directory reconnaissance, lateral movement, and staged deployment across domain environments before launching the ransomware. In at least one documented campaign, the time from initial infection to domain-wide ransomware execution was roughly half a day.

Delivery and access patterns vary by affiliate and campaign. Nokoyawa has been observed following phishing-delivered malware infections, including HTML smuggling chains that led to IcedID and then hands-on-keyboard ransomware deployment. It has also been associated with exploitation of vulnerabilities for privilege escalation, including abuse of the Windows Common Log File System vulnerability CVE-2023-28252 prior to attempted ransomware deployment. Reporting also links Nokoyawa deployment to prolific ransomware affiliates that have rotated among multiple payloads such as Hive, BlackCat, Agenda, and Mindware.

Victimology has included organizations in South America, especially Argentina, as well as broader enterprise targets in other regions. Repeated overlap in leak-site victim postings with groups such as Snatch has been noted, suggesting possible coordination, shared access, or shared leak infrastructure in some cases. Nokoyawa remains notable for its rapid technical evolution, affiliate-oriented configurability, and role within the broader professionalized ransomware ecosystem.