Farnetwork

Farnetwork, a notorious malware operator identified by cybersecurity researchers from Group-IB, has been active in the cybercrime scene since 2019. Known for deploying five different strains of ransomware, including its proprietary strain Nokoyawa, Farnetwork has collaborated with other cybercriminal groups and infiltrated numerous affiliates, including Qilin and Farnetwork itself. The group operates under various aliases on underground sites, such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Despite Farnetwork's denial of being the developer behind Nokoyawa, their involvement as an affiliate is anticipated due to their previous experience deploying Nemty and Karma ransomware strains. In 2023 alone, Farnetwork proved to be one of the most active players in the Ransomware-as-a-Service (RaaS) market. Their case exposed the group’s payment structure and policy around initial intrusions into victims’ networks. Interestingly, Farnetwork grants affiliates access to corporate networks of targeted companies, which escalates the potential impact of their activities. However, despite their aggressive operations, the group announced on June 19, 2023, that they would cease recruiting new hires and expressed intentions to retire from hacking. Despite this retirement announcement and the closure of Nokoyawa DLS, their latest known project, Group-IB researchers believe that Farnetwork's exit from the cybercrime world is unlikely. Based on the group's history, it is suspected that they will return under a different name with a new RaaS program. This prediction is grounded in the evidence suggesting that Farnetwork not only manages RaaS programs but also develops ransomware themselves. Therefore, the cybersecurity community remains vigilant for new large-scale criminal operations potentially orchestrated by Farnetwork.