● Malware

NOKKI

NOKKI is a modular remote access tool. The earliest observed attack using NOKKI was in January 2018. NOKKI has significant code overlap with the KONNI malware family. There is some evidence potentially linking NOKKI to APT37.

View graph Watch Export

Indicators tracked

Intelligence Reports20

20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

17 relationships

T1033: System Owner/User Discovery

source

T1218.011: Rundll32

source

T1074.001: Local Data Staging

source

T1036.005: Match Legitimate Resource Name or Location

source

T1082: System Information Discovery

source

T1140: Deobfuscate/Decode Files or Information

source

T1016: System Network Configuration Discovery

source

T1071.002: File Transfer Protocols

source

T1547.001: Registry Run Keys / Startup Folder

source

T1027: Obfuscated Files or Information

source

T1070.004: File Deletion

source

T1071.001: Web Protocols

source

T1105: Ingress Tool Transfer

source

T1680: Local Storage Discovery

source

T1124: System Time Discovery

source

T1056.004: Credential API Hooking

source