nokoyawa
First seen December 9, 2022Active36 claimed victims
The claims below are reproduced as posted by nokoyawa on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Nokoyawa is a double-extortion ransomware group that launched a RaaS program in 2022 (operated by threat actor "farnetwork"), primarily targeting businesses in South America across healthcare, financial services, government, and manufacturing, gaining significant attention in 2023 for exploiting a Windows CLFS zero-day (CVE-2023-28252).
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Studio Domaine LLC | August 4, 2023 | ransomware_live | — |
| Roman Catholic Diocese of Albany | August 3, 2023 | ransomware_live | — |
| Pea River Electric Cooperative | August 1, 2023 | ransomware_live | — |
| One Health Solutions | July 29, 2023 | ransomware_live | — |
| Modern Eyez | July 29, 2023 | ransomware_live | — |
| Village Church of Barrington | July 29, 2023 | ransomware_live | — |
| AT&S | July 29, 2023 | ransomware_live | — |
| Muncy Homes | July 29, 2023 | ransomware_live | — |
| CANAROPA Inc | July 20, 2023 | ransomware_live | — |
| Tampa General Hospital | July 20, 2023 | ransomware_live | — |
| Roadies | May 29, 2023 | ransomware_live | — |
| Liveaction inc. | May 22, 2023 | ransomware_live | — |
| Global Remote Services | May 22, 2023 | ransomware_live | — |
| Medical University of the Americas | May 20, 2023 | ransomware_live | — |
| Miami University | May 20, 2023 | ransomware_live | — |
| Chattanooga State Community | May 18, 2023 | ransomware_live | — |
| Hyundai Motors Etats-Unis | May 14, 2023 | ransomware_live | — |
| ePerformax | May 13, 2023 | ransomware_live | — |
| Wyoming County Community Health System | May 12, 2023 | ransomware_live | — |
| Canopy Children's Solutions | May 11, 2023 | ransomware_live | — |
| Fresca | May 4, 2023 | ransomware_live | — |
| Rural Workforce Agency | April 27, 2023 | ransomware_live | — |
| Canadian Nurses Association | April 24, 2023 | ransomware_live | — |
| Sabin | April 20, 2023 | ransomware_live | — |
| Snodland C of E Primary School | April 15, 2023 | ransomware_live | — |
| Stockmann Natursteine & Fliesen | April 15, 2023 | ransomware_live | — |
| Accurate Auto Insurance | April 15, 2023 | ransomware_live | — |
| Guardian Fine Art Services | April 9, 2023 | ransomware_live | — |
| comcom-sgc | April 9, 2023 | ransomware_live | — |
| Pueblo Mechanical & Controls | April 3, 2023 | ransomware_live | — |
| City of Modesto | April 2, 2023 | ransomware_live | — |
| Gaston College | March 9, 2023 | ransomware_live | — |
| MSX International | February 22, 2023 | ransomware_live | — |
| Miescor | January 25, 2023 | ransomware_live | — |
| CONEX | January 20, 2023 | ransomware_live | — |
| Nexon Asia Pacific | December 9, 2022 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).