CYBERSECURITYTRACKER
Incidents

Karakurt

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware108 leak-site claims, all timeLatest observed leak-site post 2023-09-22
ORKL search ↗

Portable threat brief

Karakurt

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor
Karakurt
Kind
ransomware
Latest observed
2023-09-22
Leak-site claims
108
Catalogued techniques
0

Scope

Tracked sectors
Healthcare, Construction & Engineering, Manufacturing, Education, Retail
Claim records
2022-08-18 to 2023-09-22
Suspected origin
[Unknown]
Motivation
Financial gain
Targeted industries
Energy, Entertainment, Healthcare, Hospitality, Industrial, Manufacturing, Retail, Technology
Targeted countries
USA, Europe

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

© Electronic Transactions Development Agency, 2019-2026. ETDA/ThaiCERT Threat Group Cards, CC BY-NC-SA 4.0; source card. The tracker uses an exact name-or-alias join and reformats the attributed fields. All information contained herein is provided on an “As Is” basis with no warranty whatsoever.

Most-claimed sectorsHealthcareConstruction & EngineeringManufacturingEducationRetail
Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records
First observed Latest observed
Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation
Suspected origin
[Unknown]
Motivation
Financial gain
Targeted industries
Energy, Entertainment, Healthcare, Hospitality, Industrial, Manufacturing, Retail, Technology
Targeted countries
USA, Europe

Attributed by ETDA Threat Group Cards (Source last updated: ), by an exact name or alias match.

Sourced threat-actor profile: MISP Galaxy (Malware Information Sharing Platform)
Also known as
Karakurt Lair

Source: MISP Galaxy, CC0 1.0 Universal or BSD-2-Clause, by an exact match on the name or one of its listed alternate names.

Cited references: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a, https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group, https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand
108 on this site
View all on Breaches →
Leak-site claim activity

Claims per month, 2022-08 to 2023-09. Peak 29 in 2022-08.

2022-082023-09
Show monthly counts as a table
MonthClaims
2022-0829
2022-094
2022-1029
2022-1113
2022-121
2023-011
2023-020
2023-034
2023-0411
2023-053
2023-065
2023-073
2023-083
2023-092

0 additional claims without a disclosure date

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

Glossary

Open in glossary