Farnetwork

Malware Profile Updated 3 months ago

Download STIX

Preview STIX

Farnetwork, a notorious malware operator identified by cybersecurity researchers from Group-IB, has been active in the cybercrime scene since 2019. Known for deploying five different strains of ransomware, including its proprietary strain Nokoyawa, Farnetwork has collaborated with other cybercriminal groups and infiltrated numerous affiliates, including Qilin and Farnetwork itself. The group operates under various aliases on underground sites, such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Despite Farnetwork's denial of being the developer behind Nokoyawa, their involvement as an affiliate is anticipated due to their previous experience deploying Nemty and Karma ransomware strains. In 2023 alone, Farnetwork proved to be one of the most active players in the Ransomware-as-a-Service (RaaS) market. Their case exposed the group’s payment structure and policy around initial intrusions into victims’ networks. Interestingly, Farnetwork grants affiliates access to corporate networks of targeted companies, which escalates the potential impact of their activities. However, despite their aggressive operations, the group announced on June 19, 2023, that they would cease recruiting new hires and expressed intentions to retire from hacking. Despite this retirement announcement and the closure of Nokoyawa DLS, their latest known project, Group-IB researchers believe that Farnetwork's exit from the cybercrime world is unlikely. Based on the group's history, it is suspected that they will return under a different name with a new RaaS program. This prediction is grounded in the evidence suggesting that Farnetwork not only manages RaaS programs but also develops ransomware themselves. Therefore, the cybersecurity community remains vigilant for new large-scale criminal operations potentially orchestrated by Farnetwork.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Jsworm	3	JSWorm is a type of malware, specifically ransomware, that was active from 2019 to 2021. This malicious software was developed and operated by a threat actor known as 'farnetwork', who has used various aliases including farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Farnetwork gai
Farnetworkit	2	Farnetworkit, a malicious software or malware, has been active since 2019 under various aliases such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetwork. This cybercriminal entity has been involved in several ransomware projects including JSWORM, Karma, Nemty, and Nefilim. Farnetworkit
Razvrat	1	Razvrat is a malicious software, or malware, known for its damaging effects on computer systems. It infiltrates systems undetected through suspicious downloads, emails, or websites, with the potential to steal personal information, disrupt operations, or hold data hostage for ransom. The malware was
Farnetworkl	1	None
Jingo	1	None

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

RaaS

Ransomware

Encryption

Encrypt

Cybercrime

Botnet

Ransom

Exploit

Trojan

Malware

Locker

Vpn

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Nokoyawa	is related to	5	Nokoyawa is a notorious malware, particularly known for its ransomware capabilities. It has been associated with various other malicious software including Quantum, Royal, BlackBasta, Emotet, IcedID, CobaltStrike, SVCReady, CargoBay, Pushdo, Minodo, DiceLoader, AresLoader, LummaC2, Vidar, Gozi, Cany
Nemty	Unspecified	2	Nemty is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It was developed by a cybercriminal group known as farnetwork, which has been active since 2019. Farnetwork has been involved in several ransomware projects, including JSWORM, Nefilim, Karma, an
Nefilim	Unspecified	2	Nefilim is a malware, specifically a ransomware, that has been responsible for significant cyber threats globally. It infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Between 2019 and 2021,
Piparuka	Unspecified	1	None
Raccoon	Unspecified	1	Raccoon is a highly potent and cost-effective Malware-as-a-Service (MaaS) primarily sold on dark web forums, used extensively by Scattered Spider threat actors to pilfer sensitive data. As per the "eSentire Threat Intelligence Malware Analysis: Raccoon Stealer v2.0" report published on August 31, 20

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Qilin	Unspecified	1	Qilin, a notable threat actor in the cybersecurity landscape, has been significantly active over the last two years, compromising more than 150 organizations across 25 countries and various industries. Originally evolving from the Agenda ransomware written in Go, Qilin has since transitioned to Rust
Shadowsyndicate	Unspecified	1	ShadowSyndicate, a threat actor that emerged in 2019, has been implicated in multiple ransomware operations according to cybersecurity firm Group-IB. The group is known for its affiliations with various ransomware groups and programs, and has been involved in several ransomware projects such as JSWO

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
CVE-2023-28252	Unspecified	1	CVE-2023-28252 is a critical Elevation of Privilege vulnerability found in the Windows Common Log File System (CLFS) driver. This flaw was discovered by Kaspersky researchers while preventing attacks on users, marking it as a zero-day vulnerability. The vulnerability presents a significant risk with

Source Document References

Information about the Farnetwork Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
CERT-EU	7 months ago	Cyber sleuths reveal how they infiltrate the biggest ransomware gangs • The Register \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	8 months ago	Les dernières cyberattaques (14 novembre 2023)
CERT-EU	8 months ago	Threat Intelligence Work Reveals Threat Actor Farnetwork Operations
CERT-EU	8 months ago	From Concealed to Revealed: Dark Web Slip-Up Exposes Ransomware Mastermind
BankInfoSecurity	9 months ago	Breach Roundup: Mr. Cooper Recovers From Hacking Incident
CERT-EU	9 months ago	Prolific ransomware crook spills the beans on several operations
CERT-EU	9 months ago	Ransomware Mastermind Uncovered After Oversharing on Dark Web
DARKReading	9 months ago	Ransomware Mastermind Uncovered After Oversharing on Dark Web
CERT-EU	9 months ago	Inside Farnetwork Operation: a Major RaaS Player
CERT-EU	9 months ago	Russian-speaking threat actor "farnetwork" linked to 5 ransomware gangs
CERT-EU	9 months ago	Experts Expose Farnetwork's Ransomware-as-a-Service Business Model
InfoSecurity-magazine	9 months ago	Threat Actor Farnetwork Linked to Five Ransomware Schemes