Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

NOKOYAWA · Threat actor profile

// THREAT ACTOR

NOKOYAWA_

Dormant

NOKOYAWA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of NOKOYAWA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

35 Victims tracked
0 / 28 Active mirrors
2022-12-23 First listing
2023-08-04 Most recent

Victims by year

  • 2023 34
  • 2022 1

Leak site mirrors

28 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • lirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion
  • 6yofnrq7evqrtz3tzi3dkbrdovtywd35lx3iqbc5dyh367nrdh4jgfyd.onion NOKOYAWA Leaks snapshot · 2023-01-25 22:04
  • nokoleakb76znymx443veg4n6fytx6spck6pc7nkr4dvfuygpub6jsid.onion Wall of Shame snapshot · 2023-10-08 10:03
  • accurfjvcphjtfogx42gpmoobffwqpqzvv2mf7smr6no62fy7ootjnid.onion snapshot · 2024-12-11 08:57
  • canarodqqttgf2ofv7rkj74jvani7f2ftrbkmuw7zwyydlxikazimyqd.onion snapshot · 2024-12-11 08:57
  • chattms45un5jmh23dak7udp2vt3dp25rlifqszvrhx2mb2psieyybid.onion snapshot · 2024-12-11 08:58
  • cnaaiic2skxbhnm35xmh3sohqgulpiyocj7yv7shrw4t34r5bvqbbayd.onion snapshot · 2024-12-11 08:58
  • comcomtjphtjl5mrtguatt5rgi4hymyrnzpqi6faztwmt6kw5tczqyad.onion snapshot · 2024-12-11 08:58
  • domaing5xpfmowjeah2z3icrxcbxd6e5mzk5gduohgzijrmm6lr3vxyd.onion snapshot · 2024-12-11 08:58
  • eperfs2u7bnyzpavtje6ruuwzatpzexdbjejdijgmgbe7wjje7lmkqyd.onion snapshot · 2024-12-11 08:58
  • frescayge2pa3epoytdocxz2vzagphzmrl6sqxrvrowftso4oqreh3ad.onion snapshot · 2024-12-11 08:59
  • gaston333sywqydo4mudwjgbeieryqut4trd34kntirejrvwefp4wwyd.onion snapshot · 2024-12-11 08:59
  • grsrobpx6t7j7eu4zi2xqm6fsrztaoptz4tie5xoamge6c3byeo462qd.onion snapshot · 2024-12-11 08:59
  • guardxxhqcmyddgikmgmdjpljhgwo7s4p7nnfljo54ogjd5vpu2labid.onion snapshot · 2024-12-11 08:59
  • hyundaiyo7kxalnkcghqpkfvapevwicis3ytnnue6xqivuvuvi5cnhyd.onion snapshot · 2024-12-11 08:59
  • mruedu746yv2hnsfxwgglxpqbtlgfu7xwschm7w5cl2okanfjhu6vgad.onion snapshot · 2024-12-11 09:00
  • modestorxo4s2vkjxo6xyue2lz7zefavtftb44apjojc5qhszq4dqnyd.onion snapshot · 2024-12-11 09:00
  • msxiy2dutavkdwxbjge2lnut4x7ai4z2xb3ay324tqzxgryrhahbazad.onion snapshot · 2024-12-11 09:00
  • muaedu3espka2gw5yqopmglslckonkeiduvymfkxjkggvtfqxkqydjqd.onion snapshot · 2024-12-11 09:00
  • pea3gvx6uyywne2f4dokv5cznsvzcayxsroai2ehozffkd576xfdm5yd.onion snapshot · 2024-12-11 09:00
  • pueblogmiocdtzj2of5556yzcl7frldcmqztxr6qcirgamzencolyhad.onion snapshot · 2024-12-11 09:00
  • rcdauehrqqex6pghmphfqz2jpuro2guhyenkolm2wld6bez344cbvmad.onion snapshot · 2024-12-11 09:01
  • roadiewfshampm6ee56olxymma7iwlhecjgekezmfviua5zv6vkoqzad.onion snapshot · 2024-12-11 09:01
  • rwavdkltqjoi62kvugd5m576uyn4yrlxcpwril5simavxv7z6xrxrbyd.onion snapshot · 2024-12-11 09:01
  • sabinwgf7aryxeel2ivx243tzymlsuk2s4lmrqnqn7hug5xecy6ob6ad.onion snapshot · 2024-12-11 09:01
  • snodfytsyn25r2umgfbygj7gxvul7egr4yx4j4n4yn7nb7crabafzwid.onion snapshot · 2024-12-11 09:01
  • stockkyjeldgtaj3evbtfb4id7jxnde6qnt6so3ndipcndykgknjlyyd.onion snapshot · 2024-12-11 09:01
  • wcch72vqgvsgcv4ic3awnonoqgspum6p47m4thum52rbq4fu3ctu6sqd.onion snapshot · 2024-12-11 09:01

Recent victims

The 50 most recent victims claimed by NOKOYAWA. Total in the index: 35.

Date listed Victim Description
2023-08-04 Studio Domaine LLC Studio Domaine is an innovative design firm dedicated to creating pers…
2023-08-03 Roman Catholic Diocese of Albany The Roman Catholic Diocese of Albany covers 14 counties in Eastern New…
2023-08-01 Pea River Electric Cooperative Pea River Electric Cooperative is a service-oriented, distribution ele…
2023-07-29 Muncy Homes Muncy Homes was founded in 1973 in the stable and skilled labor enviro…
2023-07-29 AT&S AT&S was incorporated in Singapore in 2009 with the goal to provide th…
2023-07-29 Village Church of Barrington The Village Church is an religious institution founded in 1977 and is …
2023-07-29 Modern Eyez Since 2003, Modern Eyez has been the leader and preferred provider of …
2023-07-29 One Health Solutions ONE HEALTH is a pioneering healthcare platform that is the result of a…
2023-07-20 CONEX CONEX is a customs procedure management software specialist. Our SaaS …
2023-07-20 Miescor Incorporated in December 1973 as a wholly owned subsidiary of Manila E…
2023-07-20 MSX International For more than 25 years, MSX International has been a dedicated partner…
2023-07-20 Gaston College Gaston College is a public community college in Dallas, North Carolina…
2023-07-20 City of Modesto Modesto is the county seat and largest city of Stanislaus County, Cali…
2023-07-20 Pueblo Mechanical & Controls Pueblo Mechanical & Controls is a leading provider of commercial HVAC …
2023-07-20 comcom-sgc The community of communes of Grand Couronné is a former French communi…
2023-07-20 Guardian Fine Art Services GUARDIAN is the premier fine art storage facility in the Chicago-Milwa…
2023-07-20 Accurate Auto Insurance Accurate Auto Insurance was founded in 1992 in Chicago, Illinois. We h…
2023-07-20 Stockmann Natursteine & Fliesen Welcome to Stockmann Natursteine & Fliesen - your natural stone and ti…
2023-07-20 Snodland C of E Primary School Snodland Church of England Primary School is a school that we are all …
2023-07-20 Sabin Sabin Laboratory is one of the leading medical diagnostics companies i…
2023-07-20 Canadian Nurses Association Canadian Nurses Association is located in Ontario, Canada and was foun…
2023-07-20 Rural Workforce Agency Rural Workforce Agency Victoria (RWAV) is a not-for-profit government …
2023-07-20 Fresca Founded in 2004, Fresca is headquartered in Kent, United Kingdom. Fres…
2023-07-20 Canopy Children's Solutions Canopy Children’s Solutions (Canopy), formerly Mississippi Children’s …
2023-07-20 Wyoming County Community Health System Wyoming County Community Health System has been serving Wyoming County…
2023-07-20 ePerformax In 1988 the Performance Consulting Group was founded by Teresa Hartsaw…
2023-07-20 Hyundai Motors Etats-Unis Hyundai Motors Etats-Unis is a company that operates in the Automotive…
2023-07-20 Chattanooga State Community Chattanooga State Community College is a public community college in C…
2023-07-20 Miami University Established in 1809, Miami University is consistently ranked among the…
2023-07-20 Medical University of the Americas Medical University of the Americas (MUA) is a private for-profit offsh…
2023-07-20 Global Remote Services GRS provides personalized management services for its clients across a…
2023-07-20 Roadies Roadies, a fast-growing and innovative logistics company that provides…
2023-07-20 Tampa General Hospital Tampa General Hospital is a private not-for-profit hospital and one of…
2023-07-20 CANAROPA Inc Canaropa, founded in 1954 and headquartered in Quebec, Canada, is a le…
2022-12-23 Nexon Asia Pacific Nexon is headquartered in Sydney, New South Wales. Nexon Asia Pacific …

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.