<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 14.67px;">Hello,</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin:0px;font-size:12pt;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0)"><span style="margin:0px;background-color:rgb(255, 255, 255);display:inline !important"></span>
<div style="margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px">
<div style="margin:0px;color:rgb(0, 0, 0) !important;background-color:rgb(255, 255, 255)">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;font-size:12pt;color:rgb(0, 0, 0) !important">
<div style="margin:0px;background-color:rgb(255, 255, 255) !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:15px;color:rgb(32, 31, 30) !important;background-color:white !important">
<div style="margin:0px;font-size:12pt;color:black !important"><span style="margin:0px;background-color:white !important"></span>
<div style="margin:0px;background-color:white !important">
<div style="margin:0px;font-size:14.67px;background-color:white !important">I hope everyone is doing well!</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important"><br>
</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important">Below is the entry for today.</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important"><br>
</div>
<div style="margin:0px;font-size:14.67px;background-color:white !important">03/10/2022 - Diary entry #467<br>
</div>
<blockquote style="font-size:14.67px;margin-top:0px;margin-bottom:0px;background-color:white !important">
<div style="margin:0px"><br>
</div>
<div style="margin:0px"></div>
Disclosed this month, Nokoyawa Ransomware is a new threat in the ransomware landscape. After being executed in the device, Nokoyawa encrypts files using AES + RSA, appending .NOKOYAWA extension to the encrypted files. A ransom note is dropped on each directory,
under the name NOKOYAWA_readme.txt, containing e-mails that can be used to negotiate for the decryptor. Although they don't seem to have a wall-of-shame website, they claim that if the ransom is not paid, the files will be leaked to media.
<div><br>
</div>
<div>Nokoyawa Ransowmare share similarities with Hive Ransomware, covered in our Daily Diary #332 and in our Daily Diary #400 after compromising Supernus Pharmaceuticals. Besides sharing strings, in both Nokoyawa and Hive attacks Colbalt Strike beacon was used,
along with trusted legitimate tools like GMER and PC Hunter for defense evasion and PsExec for lateral movement.</div>
<div><br>
</div>
In February 2022, a group of researchers published an article defeating Hive Ransomware encryption, after a vulnerability in the malware's key generation process was discovered, allowing a success rate around 96% to recover the files without paying for the
ransom. Nokoyawa Ransomware could be a response to that, with a new encryption procedure to get back on the game.
<div style="margin:0px"><br>
</div>
<div style="margin:0px"></div>
<div style="margin:0px"></div>
</blockquote>
<span style="margin:0px;font-size:14.67px;background-color:white !important">Kind Regards,</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-family:"Times New Roman"; font-size:medium; text-align:start">
<tbody>
<tr>
<td width="180" align="left" style="width:180px">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/"><img alt="" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/"><img width="18" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity"><img width="20" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ"><img width="26" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p> </p>
</td>
<td width="350" colspan="2" rowspan="2" style="width:350px">
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
<strong>Felipe Duarte Domingues</strong><br>
Security Researcher<br>
<strong>Appgate</strong></p>
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
E:<span> </span><font color="#228ebe"><a href="mailto:felipe.duarte@appgate.com" title="mailto:felipe.duarte@appgate.com">felipe.duarte@appgate.com</a></font><br>
O: <span style="background-color:rgb(255,255,255); display:inline!important">+55 19 98840 2509</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>