Kraken

Kraken is a Russian-speaking ransomware operation that emerged in 2025 and is assessed to have developed from remnants of the HelloKitty ransomware cartel. It has been described as both a ransomware-as-a-service operation and a successor grouping within the broader Russian-language cybercrime ecosystem. Kraken conducts big-game hunting intrusions and uses double extortion, combining data theft with file encryption and public leak-site pressure. Kraken targets Windows, Linux, and VMware ESXi environments with platform-specific encryptors, indicating a mature cross-platform capability. Its operators benchmark victim systems before encryption to determine whether to apply full or partial encryption, optimizing impact while avoiding excessive performance degradation. Observed functionality includes encryption of local drives, network shares, Microsoft SQL data, and virtual machine disk files. On Linux and ESXi systems, Kraken can enumerate and terminate virtual machines to unlock disk files for encryption. Reported intrusion patterns include exploitation of SMB vulnerabilities for initial access, theft of administrative credentials, re-entry via RDP, use of tunneling and remote filesystem tooling to support exfiltration, and movement across reachable systems. Pre-encryption actions include deleting shadow copies, clearing recovery-related artifacts, stopping backup services, and anti-analysis or anti-forensics measures. Post-encryption cleanup has included self-removing scripts that erase logs, shell history, and ransomware artifacts. Kraken has publicly claimed victims in multiple countries and has operated a leak site to pressure organizations after data theft. It has also been linked to the launch of an underground forum called The Last Haven Board, reflecting participation in the wider Russian-language criminal ecosystem. Known aliases include Kraken Group, and reporting has also linked the operation to the HelloKitty lineage.