H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

NOKKI

[NOKKI](https://attack.mitre.org/software/S0353) is a modular remote access tool. The earliest observed attack using [NOKKI](https://attack.mitre.org/software/S0353) was in January 2018. [NOKKI](https://attack.mitre.org/software/S0353) has significant code overlap with the [KONNI](https://attack.mitre.org/software/S0356) malware family. There is some evidence potentially linking [NOKKI](https://attack.mitre.org/software/S0353) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[NOKKI](https://attack.mitre.org/software/S0353) is a modular remote access tool. The earliest observed attack using [NOKKI](https://attack.mitre.org/software/S0353) was in January 2018. [NOKKI](https://attack.mitre.org/software/S0353) has significant code overlap with the [KONNI](https://attack.mitre.org/software/S0356) malware family. There is some evidence potentially linking [NOKKI](https://attack.mitre.org/software/S0353) to [APT37](https://attack.mitre.org/groups/G0067).(Citation: Unit 42 NOKKI Sept 2018)(Citation: Unit 42 Nokki Oct 2018)

Labels

malware
17 recorded

Relationships

uses
from Kimsuky
Group
uses
to Credential API Hooking
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to File Deletion
Technique
uses
to File Transfer Protocols
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Local Data Staging
Technique
uses
to Local Storage Discovery
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rundll32
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to System Time Discovery
Technique
uses
to Web Protocols
Technique
4 external

References

mitre-attack
S0353
open
NOKKI
—
Unit 42 Nokki Oct 2018
https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/
open
Unit 42 NOKKI Sept 2018
https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance