MITRE ATT&CKsoftware (malware)

S0353 NOKKI

Published 2019-01-30 Modified 2025-10-22 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.2
Created: 2019-01-30

Description

NOKKI is a modular remote access tool. The earliest observed attack using NOKKI was in January 2018. NOKKI has significant code overlap with the KONNI malware family. There is some evidence potentially linking NOKKI to APT37.

Uses · MITRE ATT&CK (16)

T1680 Local Storage Discovery technique
T1071.001 Web Protocols sub-technique
T1071.002 File Transfer Protocols sub-technique
T1074.001 Local Data Staging sub-technique
T1056.004 Credential API Hooking sub-technique
T1036.005 Match Legitimate Resource Name or Location sub-technique
T1070.004 File Deletion sub-technique
T1218.011 Rundll32 sub-technique
T1547.001 Registry Run Keys / Startup Folder sub-technique
T1140 Deobfuscate/Decode Files or Information technique
T1016 System Network Configuration Discovery technique
T1027 Obfuscated Files or Information technique
T1033 System Owner/User Discovery technique
T1082 System Information Discovery technique
T1105 Ingress Tool Transfer technique
T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

G0094 Kimsuky group

References

https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/ Unit 42 Nokki Oct 2018
https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/ Unit 42 NOKKI Sept 2018

S0353 NOKKI

Description

Related

Uses · MITRE ATT&CK (16)

Referenced by MITRE ATT&CK · uses (1)

References