Karakurt
Also known as Karakurt Lair
Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors have claimed to steal data and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom. Known ransom demands have ranged from $25,000 to $13,000,000 in Bitcoin, with payment deadlines typically set to expire within a week of first contact with the victim.
Targets: Canada, Germany, United Kingdom, United States
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a
- https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group
- https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation
- https://www.ransomlook.io/group/karakurt
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.