Farnetwork

Malware Profile Updated 13 days ago
Download STIX
Preview STIX
Farnetwork, a notorious malware operator identified by cybersecurity researchers from Group-IB, has been active in the cybercrime scene since 2019. Known for deploying five different strains of ransomware, including its proprietary strain Nokoyawa, Farnetwork has collaborated with other cybercriminal groups and infiltrated numerous affiliates, including Qilin and Farnetwork itself. The group operates under various aliases on underground sites, such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Despite Farnetwork's denial of being the developer behind Nokoyawa, their involvement as an affiliate is anticipated due to their previous experience deploying Nemty and Karma ransomware strains. In 2023 alone, Farnetwork proved to be one of the most active players in the Ransomware-as-a-Service (RaaS) market. Their case exposed the group’s payment structure and policy around initial intrusions into victims’ networks. Interestingly, Farnetwork grants affiliates access to corporate networks of targeted companies, which escalates the potential impact of their activities. However, despite their aggressive operations, the group announced on June 19, 2023, that they would cease recruiting new hires and expressed intentions to retire from hacking. Despite this retirement announcement and the closure of Nokoyawa DLS, their latest known project, Group-IB researchers believe that Farnetwork's exit from the cybercrime world is unlikely. Based on the group's history, it is suspected that they will return under a different name with a new RaaS program. This prediction is grounded in the evidence suggesting that Farnetwork not only manages RaaS programs but also develops ransomware themselves. Therefore, the cybersecurity community remains vigilant for new large-scale criminal operations potentially orchestrated by Farnetwork.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Jsworm
3
JSWorm is a type of malware, specifically ransomware, that was active from 2019 to 2021. This malicious software was developed and operated by a threat actor known as 'farnetwork', who has used various aliases including farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Farnetwork gai
Farnetworkit
2
Farnetworkit, a malicious software or malware, has been active since 2019 under various aliases such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetwork. This cybercriminal entity has been involved in several ransomware projects including JSWORM, Karma, Nemty, and Nefilim. Farnetworkit
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
RaaS
Ransomware
Encryption
Encrypt
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Nokoyawais related to
5
Nokoyawa is a notorious malware, particularly known for its ransomware capabilities. It has been associated with various other malicious software including Quantum, Royal, BlackBasta, Emotet, IcedID, CobaltStrike, SVCReady, CargoBay, Pushdo, Minodo, DiceLoader, AresLoader, LummaC2, Vidar, Gozi, Cany
NefilimUnspecified
2
Nefilim is a malware, specifically a ransomware, that has been responsible for significant cyber threats globally. It infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Between 2019 and 2021,
NemtyUnspecified
2
Nemty is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It was developed by a cybercriminal group known as farnetwork, which has been active since 2019. Farnetwork has been involved in several ransomware projects, including JSWORM, Nefilim, Karma, an
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Farnetwork Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
6 months ago
Prolific ransomware crook spills the beans on several operations
CERT-EU
6 months ago
Russian-speaking threat actor "farnetwork" linked to 5 ransomware gangs
DARKReading
6 months ago
Ransomware Mastermind Uncovered After Oversharing on Dark Web
CERT-EU
6 months ago
Threat Intelligence Work Reveals Threat Actor Farnetwork Operations
CERT-EU
6 months ago
Inside Farnetwork Operation: a Major RaaS Player
CERT-EU
6 months ago
Experts Expose Farnetwork's Ransomware-as-a-Service Business Model
CERT-EU
6 months ago
From Concealed to Revealed: Dark Web Slip-Up Exposes Ransomware Mastermind
BankInfoSecurity
6 months ago
Breach Roundup: Mr. Cooper Recovers From Hacking Incident
InfoSecurity-magazine
6 months ago
Threat Actor Farnetwork Linked to Five Ransomware Schemes
CERT-EU
6 months ago
Ransomware Mastermind Uncovered After Oversharing on Dark Web
CERT-EU
5 months ago
Cyber sleuths reveal how they infiltrate the biggest ransomware gangs • The Register | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware | National Cyber Security Consulting
CERT-EU
6 months ago
Les dernières cyberattaques (14 novembre 2023)