mailto

Aliases: Koko Ransomware, NetWalker

First seen
2019-08-01 00:00:00
Malware type
ransomware
Family
Malware family
Related IoCs
2
Last IoC activity
2026-10-10 07:52:42
Profile updated
2026-07-07 12:37:31

Targeted industries: education-and-nonprofits healthcare-and-pharmaceutical government-and-public-sector technology-and-telecommunications energy-and-utilities

Context

NetWalker, also known as Mailto or Koko Ransomware, is a ransomware family that has been employed in targeted attacks against various industries. It encrypts files on compromised systems and demands ransom payments to decrypt them. The ransomware is known for targeting primarily high-profile sectors including healthcare, government, and education.

Detection coverage

  • 4 YARA rules

Detection rules

  • MALPEDIA_Win_Mailto_Auto (yara-rule)
  • TRELLIX_ARC_Netwalker_Ransomware (yara-rule)
  • TRELLIX_ARC_Netwalker_Signed (yara-rule)
  • TRELLIX_ARC_Netwalker (yara-rule)

Reports & references

  • CrowdStrike — Analysis Of Ecrime Menu Style Toolkits (report)
  • CrowdStrike — Reportcsit 20081E (report)
  • CrowdStrike — Report2021Gtr (report)
  • Cisco Talos — Ctir Quarterly Trends Q4 2020 (report)
  • trellix.com — Conti Leaks Examining The Panama Papers Of Ransomware (report)
  • ESET — Eset Threat Report Q22020 (report)
  • ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
  • sites.temple.edu — Ci Rw Attacks (report)
  • therecord.media — Darkside Gang Estimated To Have Made Over 90 Million From Ransomware Attacks (report)
  • therecord.media — Ransomwhere Project Wants To Create A Database Of Past Ransomware Payments (report)
  • news.sophos.com — The Ransomware Threat Intelligence Center (report)
  • public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
  • bleepingcomputer.com — Darkside Ransomware Made 90 Million In Just Nine Months (report)
  • coveware.com — Ransomware Attack Vectors Shift As New Software Vulnerability Exploits Abound (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • Microsoft — Microsoft Digital Defense Report 2020 September (report)
  • ics-cert.kaspersky.com — Kaspersky H1 2020 Ics Report En (report)
  • ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
  • ke-la.com — To Attack Or Not To Attack Targeting The Healthcare Sector In The Underground Ecosystem (report)
  • cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
  • hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
  • Microsoft — Ransomware Groups Continue To Target Healthcare Critical Services Heres How To Reduce Risk (report)
  • paloaltonetworks.com — Unit42 Ransomware Threat Report 2021 (report)
  • pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)

External references