The Nokoyawa Ransomware Gang's Attack on One Health Solutions

The Nokoyawa ransomware gang has attacked One Health Solutions. One Health Solutions is an American digital healthcare technology organization headquartered in Pennsylvania. Nokoyawa posted One Health Solutions to its data leak site on July 29th, threatening to publish all stolen data if the organization fails to pay an unspecified ransom by August 2nd.

The Origins and Evolution of Nokoyawa Ransomware

The Nokoyawa ransomware gang was detected in February 2022 and displayed code similarities with another ransomware group, Karma. The origins of Nokoyawa ransomware can be traced back to the Nemty ransomware. The initial iteration of Nokoyawa ransomware was coded using the C programming language and employed asymmetric Elliptic Curve Cryptography (ECC) with Curve SECT233R1 (also referred to as NIST B-233). This cryptographic method utilized the Tiny-ECDH open-source library and combined it with a Salsa20 symmetric key unique to each file.

The subsequent version, Nokoyawa ransomware 2.0, maintains the use of Salsa20 for symmetric encryption but replaced the elliptic curve with Curve25519. Nokoyawa was crafted using the Rust programming language and seems to have been developed around September 2022. The shift to Rust is not unprecedented in ransomware development. Prior instances include the Hive and Agenda/Qilin ransomware families, which transitioned from the Go programming language to Rust. Furthermore, the author of RansomExx transformed their ransomware's code from C++ to Rust. The BlackCat/ALPHV ransomware family is also an example of ransomware compiled in Rust.

The growing popularity of Rust can be attributed to its focus on efficiency and concurrency, factors that enhance the effectiveness of file encryption in ransomware. Similar to the previous Nokoyawa version, the Rust iteration exclusively compiles for 64-bit Windows versions.