Jsworm

JSWorm is a type of malware, specifically ransomware, that was active from 2019 to 2021. This malicious software was developed and operated by a threat actor known as 'farnetwork', who has used various aliases including farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Farnetwork gained experience in malware development and operation management by assisting with the JSWORM, Nemty, Nefilim, and Karma ransomware strains. In April 2019, farnetwork promoted the JSWORM Ransomware-as-a-Service (RaaS) program on the Exploit hacker forum, advertising the RazvRAT malware. Farnetwork was involved in several ransomware projects, including JSWORM, Karma, Nemty, and Nefilim, helping to develop the ransomware and manage their RaaS programs. Group-IB has tracked farnetwork's activities back to January 2019, establishing links between the threat actor and the aforementioned ransomware strains. Between 2019 and 2021, farnetwork was linked to the operation of these RaaS schemes, before launching their own RaaS program based on Nokoyawa ransomware in 2022. Interestingly, early variants of Nokoyawa were essentially rebranded versions of JSWorm ransomware. However, newer versions of Nokoyawa used in attacks have shown significant divergence from the JSWorm codebase. These new versions are written in C and feature encrypted strings, marking a distinct evolution in farnetwork's malware development. Despite these changes, the connection between JSWorm and Nokoyawa underscores the persistent threat posed by farnetwork and its evolving malware operations.