Farnetwork

Malware updated 7 months ago (2024-05-04T20:45:48.451Z)

Download STIX

Preview STIX

Farnetwork, a notorious malware operator identified by cybersecurity researchers from Group-IB, has been active in the cybercrime scene since 2019. Known for deploying five different strains of ransomware, including its proprietary strain Nokoyawa, Farnetwork has collaborated with other cybercriminal groups and infiltrated numerous affiliates, including Qilin and Farnetwork itself. The group operates under various aliases on underground sites, such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Despite Farnetwork's denial of being the developer behind Nokoyawa, their involvement as an affiliate is anticipated due to their previous experience deploying Nemty and Karma ransomware strains. In 2023 alone, Farnetwork proved to be one of the most active players in the Ransomware-as-a-Service (RaaS) market. Their case exposed the group’s payment structure and policy around initial intrusions into victims’ networks. Interestingly, Farnetwork grants affiliates access to corporate networks of targeted companies, which escalates the potential impact of their activities. However, despite their aggressive operations, the group announced on June 19, 2023, that they would cease recruiting new hires and expressed intentions to retire from hacking. Despite this retirement announcement and the closure of Nokoyawa DLS, their latest known project, Group-IB researchers believe that Farnetwork's exit from the cybercrime world is unlikely. Based on the group's history, it is suspected that they will return under a different name with a new RaaS program. This prediction is grounded in the evidence suggesting that Farnetwork not only manages RaaS programs but also develops ransomware themselves. Therefore, the cybersecurity community remains vigilant for new large-scale criminal operations potentially orchestrated by Farnetwork.

Description last updated: 2024-05-04T16:44:52.947Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Jsworm is a possible alias for Farnetwork. JSWorm is a type of malware, specifically ransomware, that was active from 2019 to 2021. This malicious software was developed and operated by a threat actor known as 'farnetwork', who has used various aliases including farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Farnetwork gai	3
Farnetworkit is a possible alias for Farnetwork. Farnetworkit, a malicious software or malware, has been active since 2019 under various aliases such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetwork. This cybercriminal entity has been involved in several ransomware projects including JSWORM, Karma, Nemty, and Nefilim. Farnetworkit	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

RaaS

Ransomware

Encryption

Encrypt

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Nokoyawa Malware is associated with Farnetwork. Nokoyawa is a prominent malware, specifically ransomware, that has been linked to numerous cybercrime activities since it first emerged in 2022. It has been associated with various other malware families including Quantum, Royal, BlackBasta, and a variety of others such as Emotet, IcedID, CobaltStri	is related to	5
The Nefilim Malware is associated with Farnetwork. Nefilim is a malware, specifically a ransomware, that has been responsible for significant cyber threats globally. It infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Between 2019 and 2021,	Unspecified	2
The Nemty Malware is associated with Farnetwork. Nemty is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It was developed by a cybercriminal group known as farnetwork, which has been active since 2019. Farnetwork has been involved in several ransomware projects, including JSWORM, Nefilim, Karma, an	Unspecified	2

Source Document References

Information about the Farnetwork Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	Cyber sleuths reveal how they infiltrate the biggest ransomware gangs • The Register \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	a year ago	Les dernières cyberattaques (14 novembre 2023)
CERT-EU	a year ago	Threat Intelligence Work Reveals Threat Actor Farnetwork Operations
CERT-EU	a year ago	From Concealed to Revealed: Dark Web Slip-Up Exposes Ransomware Mastermind
BankInfoSecurity	a year ago	Breach Roundup: Mr. Cooper Recovers From Hacking Incident
CERT-EU	a year ago	Prolific ransomware crook spills the beans on several operations
CERT-EU	a year ago	Ransomware Mastermind Uncovered After Oversharing on Dark Web
DARKReading	a year ago	Ransomware Mastermind Uncovered After Oversharing on Dark Web
CERT-EU	a year ago	Inside Farnetwork Operation: a Major RaaS Player
CERT-EU	a year ago	Russian-speaking threat actor "farnetwork" linked to 5 ransomware gangs
CERT-EU	a year ago	Experts Expose Farnetwork's Ransomware-as-a-Service Business Model
InfoSecurity-magazine	a year ago	Threat Actor Farnetwork Linked to Five Ransomware Schemes