Jsworm

Malware Profile Updated 24 days ago
Download STIX
Preview STIX
JSWorm is a type of malware, specifically ransomware, that was active from 2019 to 2021. This malicious software was developed and operated by a threat actor known as 'farnetwork', who has used various aliases including farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkit. Farnetwork gained experience in malware development and operation management by assisting with the JSWORM, Nemty, Nefilim, and Karma ransomware strains. In April 2019, farnetwork promoted the JSWORM Ransomware-as-a-Service (RaaS) program on the Exploit hacker forum, advertising the RazvRAT malware. Farnetwork was involved in several ransomware projects, including JSWORM, Karma, Nemty, and Nefilim, helping to develop the ransomware and manage their RaaS programs. Group-IB has tracked farnetwork's activities back to January 2019, establishing links between the threat actor and the aforementioned ransomware strains. Between 2019 and 2021, farnetwork was linked to the operation of these RaaS schemes, before launching their own RaaS program based on Nokoyawa ransomware in 2022. Interestingly, early variants of Nokoyawa were essentially rebranded versions of JSWorm ransomware. However, newer versions of Nokoyawa used in attacks have shown significant divergence from the JSWorm codebase. These new versions are written in C and feature encrypted strings, marking a distinct evolution in farnetwork's malware development. Despite these changes, the connection between JSWorm and Nokoyawa underscores the persistent threat posed by farnetwork and its evolving malware operations.
What's your take? (Question 1 of 5)
c78432b4-4e98-443d-aa1b-bb326fa2eaf5 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Nokoyawa
3
Nokoyawa is a notorious malware, particularly known for its ransomware capabilities. It has been associated with various other malicious software including Quantum, Royal, BlackBasta, Emotet, IcedID, CobaltStrike, SVCReady, CargoBay, Pushdo, Minodo, DiceLoader, AresLoader, LummaC2, Vidar, Gozi, Cany
Farnetwork
3
Farnetwork, a notorious malware operator identified by cybersecurity researchers from Group-IB, has been active in the cybercrime scene since 2019. Known for deploying five different strains of ransomware, including its proprietary strain Nokoyawa, Farnetwork has collaborated with other cybercrimina
Farnetworkit
3
Farnetworkit, a malicious software or malware, has been active since 2019 under various aliases such as farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetwork. This cybercriminal entity has been involved in several ransomware projects including JSWORM, Karma, Nemty, and Nefilim. Farnetworkit
Nefilim
3
Nefilim is a malware, specifically a ransomware, that has been responsible for significant cyber threats globally. It infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. Between 2019 and 2021,
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Ransomware
RaaS
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
NemtyUnspecified
3
Nemty is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. It was developed by a cybercriminal group known as farnetwork, which has been active since 2019. Farnetwork has been involved in several ransomware projects, including JSWORM, Nefilim, Karma, an
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Jsworm Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
7 months ago
Russian-speaking threat actor "farnetwork" linked to 5 ransomware gangs
Securelist
a year ago
Nokoyawa ransomware attacks with Windows zero-day
CERT-EU
7 months ago
Prolific ransomware crook spills the beans on several operations
DARKReading
7 months ago
Ransomware Mastermind Uncovered After Oversharing on Dark Web
CERT-EU
a year ago
Zero-day in Microsoft Windows used in Nokoyawa ransomware attacks
CERT-EU
a year ago
New Nokoyawa ransomware attacks involve Windows zero-day
InfoSecurity-magazine
7 months ago
Threat Actor Farnetwork Linked to Five Ransomware Schemes
CSO Online
a year ago
Microsoft patches vulnerability used in Nokoyawa ransomware attacks
CERT-EU
7 months ago
From Concealed to Revealed: Dark Web Slip-Up Exposes Ransomware Mastermind