New Nokoyawa Ransomware Possibly Related to Hive

Hive, which is one of the more notable ransomware families of 2021, made waves in the latter half of the year after breaching over 300 organizations in just four months — allowing the group to earn what could potentially be millions of US dollars in profit. In March 2022, we came across evidence that another, relatively unknown, ransomware known as Nokoyawa is likely connected with Hive, as the two families share some striking similarities in their attack chain, from the tools used to the order in which they execute various steps. Currently, the majority of Nokoyawa’s targets are located in South America, primarily in Argentina.

Some of the indicators we’ve observed being shared by both Nokoyawa and Hive include the use of Cobalt Strike as part of the arrival phase of the attack, as well as the use of legitimate, but commonly abused, tools such as the anti-rootkit scanners GMER and PC Hunter for defense evasion. Other steps, such as information gathering and lateral deployment, are also similar.

The operators of the Hive ransomware are known to use other tools — such as NirSoft and MalXMR miner — to enhance their attack capabilities depending on the victim environment. Based on our analysis, Nokoyawa also does the same thing based on its victims. We’ve observed the ransomware leverage other tools such as. Mimikatz, Z0Miner, and Boxter

We also found evidence based on one of the IP addresses used by Nokoyawa that the two ransomware families share the same infrastructure.

Although we are not certain how Nokoyawa is delivered to its victims, given the similarities with Hive, it’s likely that it uses similar methods such as phishing emails for arrival.

Table 1. Similarities in the attack chain of Hive and Nokoyawa

Taking each individual step into account, the similarities might not seem as apparent — for example, Cobalt Strike is a very popular post exploitation tool that has been used by other ransomware gangs — but when taking the whole picture into account, it’s clear to see that the two ransomware families are connected. What the information gathered implies is that it’s likely that the Hive ransomware’s operators have begun using another ransomware family.

Note that we have not found any evidence that Nokoyawa has been using the double extortion technique — where the ransomware operator threatens to release critical information on a leak site in addition to encoding files — unlike Hive, which has been found to be integrating it in its attacks.

Ransomware is one of the most destructive malware types in the wild today due to its ability to compromise and leak critical data. Therefore, organizations should ensure that their information is as safe as possible from ransomware attacks. These security recommendations can help maximize their security implementation with relatively little costs:

• Enabling multifactor authentication can prevent malicious actors from compromising user accounts as part of their infiltration process.
• Users should be wary of opening unverified emails. Embedded links should never be clicked and attached files should never be opened without the proper precautions and verification as these can kickstart the ransomware installation process.
• Organizations should always adhere to the 3-2-1 rule: Create three backup copies on two different file formats, with one of the backups in a separate location.
• Patching and updating software and other systems at the soonest possible time can minimize the chance of a successful vulnerability exploitation that can lead down the road to a ransomware infection.
• Organizations can better protect themselves from ransomware attacks if they implement multilayered security setups that combine elements such as the automated detection of files and other indicators with constant monitoring for the presence of weaponized legitimate tools in their IT environment.

Correlating two different attacks, such as the one we’ve done in this blog entry with Hive and Nokoyawa, are made much easier with multilayered detection and response solutions such as Trend Micro Vision One™, which is a purpose-built threat defense platform that provides added value and new benefits beyond extended detection and response (XDR) solutions. This technology provides powerful XDR capabilities that collect and automatically correlate data across multiple security layers — email, endpoints, servers, cloud workloads, and networks — to prevent attacks via automated protection while also ensuring that no significant incidents go unnoticed.

• hxxp://185.150.117[.]186:80/asdfgsdhsdfgsdfg (Cobalt Strike download)