Home > List all groups > List all tools > List all groups using tool NOKNOK

Threat Group Cards: A Threat Actor Encyclopedia

Names	NOKNOK
Category	Malware
Type	Backdoor
Description	(Volexity) The backdoor deployed by the macOS version of the malware-laden VPN application infection chain is called NOKNOK. This is downloaded by the VPN application and executed in memory.
Information	<https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/>

Last change to this tool card: 06 March 2024

Download this tool card in JSON format

Changed	Name	Country	Observed
APT groups
	GreenCharlie		2020
	Magic Hound, APT 35, Cobalt Illusion, Charming Kitten		2012-Aug 2024

2 groups listed (2 APT, 0 other, 0 unknown)

APT groups