Russian-speaking threat actor “farnetwork” linked to 5 ransomware gangs

The operator of Nokoyawa ransomware-as-a-service (RaaS), known as ‘farnetwork’, is believed to be a highly experienced player in delivering and managing malware. Cybersecurity company Group-IB has investigated farnetwork’s activities, which include operating a botnet and managing several usernames on Russian hacker forums to recruit affiliates. It’s suggested farnetwork retired and shut down the Nokoyawa RaaS program in an attempt to cover their tracks and start fresh.