Ransomware group profile · #121 by claimed victims

Nokoyawa ransomware

Nokoyawa is a double-extortion ransomware group that launched a RaaS program in 2022 (operated by threat actor "farnetwork"), primarily targeting businesses in South America across healthcare, financial services, government, and manufacturing, gaining significant attention in 2023 for exploiting a Windows CLFS zero-day (CVE-2023-28252).

Active First seen Dec 2022

36Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

10Countries hit

28Leak-site URLs tracked, 0 online

4 Aug 2023Latest claim recorded

Victimology

Who Nokoyawa claims to have breached, from 36 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare7

Education5

Professional Services5

Manufacturing4

Retail & E-Commerce4

Energy & Utilities3

Government & Defense3

Technology2

Top countries

United States4

Canada3

United Kingdom2

Philippines1

Australia1

Brazil1

France1

Germany1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Studio Domaine LLC studiodomaine.com	Professional Services	—	4 Aug 2023
Roman Catholic Diocese of Albany rcda.org	Government & Defense	—	3 Aug 2023
Pea River Electric Cooperative peariver.com	Energy & Utilities	—	1 Aug 2023
Muncy Homes muncyhomes.com	Retail & E-Commerce	—	29 Jul 2023
AT&S atssh.com	Energy & Utilities	SG	29 Jul 2023
Village Church of Barrington vcbweb.org	Retail & E-Commerce	—	29 Jul 2023
Modern Eyez visionsource-moderneyez.com	Retail & E-Commerce	—	29 Jul 2023
One Health Solutions onehealthsolutions.com	Healthcare	—	29 Jul 2023
Tampa General Hospital tgh.org	Healthcare	—	20 Jul 2023
CANAROPA Inc canaropa.com	Manufacturing	CA	20 Jul 2023
Roadies roadiesinc.com	Transportation	—	29 May 2023
CONEX conex.net	Professional Services	—	23 May 2023

All 36 Nokoyawa victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Nokoyawa is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Nokoyawa ransomware still active?

Nokoyawa is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 August 2023.

How many victims has Nokoyawa claimed?

VULONE has recorded 36 leak-site victim claims attributed to Nokoyawa since December 2022, across 10 countries and 11 sectors.

Which industries does Nokoyawa target?

The sectors most often named on the Nokoyawa leak site are Healthcare, Education, Professional Services.

Which countries are most affected by Nokoyawa?

Most Nokoyawa victims recorded by VULONE are located in United States, Canada, United Kingdom.

Where does VULONE get Nokoyawa victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].