Loading threat actor…
Karakurt is a Russia-linked cybercriminal extortion group active since at least mid-2021 that specializes in data theft and encryption-less extortion. Rather than deploying a file-encrypting payload as its primary pressure mechanism, the group steals victim data and threatens to leak, auction, or sell it unless a ransom is paid. Karakurt has been widely linked to the Conti syndicate and is frequently assessed as a Conti-associated or former Conti-operated extortion arm used to monetize intrusions where data was exfiltrated, including cases where ransomware encryption was not deployed or was unsuccessful. Reporting and prosecutions also connect the broader organization around Karakurt with other brands including Conti, Royal, TommyLeaks, SchoolBoys, and Akira. Karakurt commonly gains access through valid accounts, stolen VPN credentials, phishing, exploitation of vulnerabilities, and access purchased from other cybercriminals or initial access brokers. The group has been observed hijacking remote access accounts, abusing remote services, and leveraging intrusion routes associated with other criminal operators. Post-compromise activity includes reconnaissance, credential recovery, domain trust enumeration, modification of domain policies, lateral movement, and extensive data exfiltration. Tools and techniques publicly associated with Karakurt operations include PowerShell-based post-exploitation, Cobalt Strike, AnyDesk for persistence and remote control, Mimikatz, Rclone, FileZilla, Mega, Ligolo-ng for tunneling and pivoting, Metasploit, Impacket, and SOCKS proxying. The group has also been associated with harassment tactics against victims, including contacting employees, partners, or clients to increase pressure. Victimology indicates broad opportunistic targeting based on ease of access rather than a narrow sector focus, but confirmed cases include healthcare organizations, financial data theft, government entities, and international organizations. North American victims have been especially prominent, with additional victims in Europe. Public reporting and court filings attribute dozens of victim organizations and multimillion-dollar ransom proceeds to Karakurt-linked activity. U.S. prosecutions tied to negotiator Deniss Zolotarjovs further describe a professionalized extortion operation that analyzed stolen data, revived stalled negotiations through so-called cold-case extortions, and used sensitive personal and health information to intensify coercion. Karakurt is best characterized as a financially motivated, Russia-linked data-extortion actor with strong historical and operational ties to the Conti ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
29 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the ransomware groups that former Conti members reportedly splintered into after Conti shut down.
Cybercrime extortion group referenced in connection with a ransomware negotiator prosecuted by U.S. authorities.
Ransomware/extortion group accused of targeting more than 54 companies, including U.S. government entities, disrupting 911 dispatch systems, stealing children's health information, and using intimidation tied to alleged access to Russian government databases and law enforcement connections.
Financially motivated cyber extortion group involved in data theft and ransom negotiations, targeting dozens of organizations and extorting victims by threatening to leak stolen data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.