The Nokoyawa ransomware gang has attacked AT&S Pte Ltd. AT&S Pte Ltd is a holding company that supplies machinery and equipment to the oil, gas, and marine sectors. It was incorporated in 2009 and is headquartered in Singapore. Nokoyawa posted AT&S Pte Ltd to its data leak site on July 29th, threatening to publish all stolen data by August 2nd if the organization fails to pay an unspecified ransom. The Nokoyawa ransomware was detected in February 2022 and displayed code similarities with another ransomware group, Karma. The origins of Nokoyawa ransomware can be traced back to the Nemty ransomware. The initial iteration of Nokoyawa ransomware was coded using the C programming language and employed asymmetric Elliptic Curve Cryptography (ECC) with Curve SECT233R1 (also referred to as NIST B-233). This cryptographic method utilized the Tiny-ECDH open-source library and combined it with a Salsa20 symmetric key unique to each file. The subsequent version, Nokoyawa ransomware 2.0, maintains the use of Salsa20 for symmetric encryption but replaced the elliptic curve with Curve25519. Nokoyawa 2.0 was crafted using the Rust programming language and seems to have been developed around September 2022. The shift to Rust is not unprecedented in ransomware development. Prior instances include the Hive and Agenda/Qilin ransomware families, which transitioned from the Go programming language to Rust. Furthermore, the author of RansomExx transformed their ransomware's code from C++ to Rust. The BlackCat/ALPHV ransomware family is also an example of ransomware compiled in Rust. The growing popularity of Rust can be attributed to its focus on efficiency and concurrency, factors that enhance the effectiveness of file encryption in ransomware. Similar to the previous Nokoyawa version, the Rust iteration exclusively compiles for 64-bit Windows versions.
This attack's description was not found, while we work on the detailed account of this attack we invite you to browse through other recent Rasomware Attacks in the table below.