Ransomware Group
Nokoyawa
Also known as: Nevada Ransomware
Status: active • First seen 2022-02 • 150+ known victims
Nokoyawa is particularly dangerous because they use secret Windows bugs that even Microsoft does not know about yet. This means they can break into computers even if you have all your updates installed.
Overview
Nokoyawa is a ransomware strain that gained notoriety for using zero-day exploits in Windows CLFS (Common Log File System). The group demonstrated sophisticated capabilities by exploiting vulnerabilities before patches were available.
Target Industries
Retail, Energy, Manufacturing, Professional Services
How They Attack
- • Zero-day exploitation
- • Windows CLFS exploits
- • Credential theft
- • Double extortion
Notable Victims
Multiple retailers (2023), Energy sector organizations
Is your business exposed?
How to Protect Against Nokoyawa
- 1.
Apply Windows patches immediately when released
- 2.
Deploy EDR with behavioral analysis
- 3.
Implement Windows attack surface reduction rules
MITRE ATT&CK Techniques
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required