Karakurt
Karakurt is a Russian-linked cybercriminal extortion group active since at least mid-2021 and widely described as a data-theft and extortion operation rather than a traditional encryption-focused ransomware group. Multiple sources in the content describe it as an extortion-only or encryption-less operation that compromises company systems, steals data, and demands payment in cryptocurrency under threat of leaking or selling the stolen information. Reported ransom demands ranged from $25,000 to $13 million in Bitcoin. The group operated a public leak site and auction portal, later adding a search capability to make stolen data easier to find and increase pressure on victims. U.S. government reporting cited in the content states Karakurt often contacted victims’ employees, business partners, and clients with harassing emails and phone calls, and published press releases naming non-paying victims. The content repeatedly links Karakurt to the Conti ecosystem. It is described as a data extortion arm, side operation, spin-off, or successor-linked group associated with former Conti members or leaders. Some reporting in the content also states that former Conti members splintered into Karakurt after Conti’s shutdown. Additional reporting cited in the content says the broader organization used multiple extortion brands, including Conti, Karakurt, Royal, TommyLeaks, SchoolBoys Ransomware, and Akira. Observed tradecraft in the content includes initial access via purchased stolen login credentials or access bought from other criminals, including stolen VPN credentials; use of Cobalt Strike, AnyDesk, Mimikatz, PowerShell, 7zip, WinZip, Rclone, FileZilla, and Mega.io; data exfiltration; and extortion without deploying encryption tools. The content also notes Karakurt has used AnyDesk as a persistence mechanism. U.S. government reporting cited in the content states the group often selected victims based on ease of access rather than industry. Victimology in the content shows heavy targeting of North America, with one source stating about 95% of victims published during a 2021 period were based there, while other victims were in Europe. Reported victims and impacts in the content include attacks on healthcare organizations, a pediatric healthcare provider, U.S. government entities including one whose 911 emergency dispatch system was disrupted, the International Centre for Migration Policy Development (ICMPD), and Chattanooga Heart Institute. The content also states Karakurt stole children’s health information in at least one case. Known aliasing and associated names directly mentioned in the content include Karakurt, TommyLeaks, SchoolBoys Ransomware, Royal, Conti, and Akira as brands used by the same broader organization in some reporting. The online alias "Sforza_cesarini" is linked in the content to member Deniss Zolotarjovs, a negotiator associated with Karakurt who was arrested in Georgia, extradited to the United States, and later sentenced in U.S. court.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the ransomware groups that former Conti members reportedly splintered into after Conti shut down.
Cybercrime extortion group referenced in connection with a ransomware negotiator prosecuted by U.S. authorities.
Ransomware/extortion group accused of targeting more than 54 companies, including U.S. government entities, disrupting 911 dispatch systems, stealing children's health information, and using intimidation tied to alleged access to Russian government databases and law enforcement connections.
Financially motivated cyber extortion group involved in data theft and ransom negotiations, targeting dozens of organizations and extorting victims by threatening to leak stolen data.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.