The Nokoyawa Ransomware Gang's Attack on Modern Eyez

The Nokoyawa ransomware gang has attacked Modern Eyez. Modern Eyez is an optometrist headquartered in Rio Rancho, New Mexico, USA. Nokoyawa posted Modern Eyez to its data leak site on July 29th, threatening to publish all stolen data by August 2nd if the organization fails to pay the ransom.

Background of Nokoyawa Ransomware

The Nokoyawa ransomware gang was detected in February 2022 and displayed code similarities with another ransomware group, Karma. The origins of Nokoyawa ransomware can be traced back to the Nemty ransomware. The initial iteration of Nokoyawa ransomware was coded using the C programming language and employed asymmetric Elliptic Curve Cryptography (ECC) with Curve SECT233R1 (also referred to as NIST B-233). This cryptographic method utilized the Tiny-ECDH open-source library and combined it with a Salsa20 symmetric key unique to each file.

Nokoyawa Ransomware 2.0

The subsequent version, Nokoyawa ransomware 2.0, maintains the use of Salsa20 for symmetric encryption but replaced the elliptic curve with Curve25519. Nokoyawa 2.0 was crafted using the Rust programming language and seems to have been developed around September 2022. The shift to Rust is not unprecedented in ransomware development. Prior instances include the Hive and Agenda/Qilin ransomware families, which transitioned from the Go programming language to Rust. Furthermore, the author of RansomExx transformed their ransomware's code from C++ to Rust. The BlackCat/ALPHV ransomware family is also an example of ransomware compiled in Rust.

The growing popularity of Rust can be attributed to its focus on efficiency and concurrency, factors that enhance the effectiveness of file encryption in ransomware. Similar to the previous Nokoyawa version, the Rust iteration exclusively compiles for 64-bit Windows versions.