Karakurt

Karakurt, also known as the Karakurt Team, Karakurt Hacking Team, and Karakurt Lair, is a Russian-linked, financially motivated cybercriminal group active since at least June 2021. It specializes in data theft and extortion without encrypting victim systems, threatening to publish or auction stolen information unless a ransom is paid. Its victims span multiple industries, including healthcare, with a strong concentration in North America and additional targeting in Europe. Karakurt has operated public and dark-web leak and auction sites. Its operational infrastructure, cryptocurrency flows, and reuse of access established by Conti connect it to the Conti syndicate, for which it served as a data-extortion arm, including monetizing intrusions when ransomware encryption was blocked. Karakurt obtains initial access through purchased credentials, criminal access brokers, cooperating intrusion groups, phishing, and exploitation of vulnerable internet-facing systems. Observed access methods include compromised VPN and RDP accounts and exploitation of Log4Shell, CVE-2021-44228. After compromise, operators use Cobalt Strike for network discovery and command and control, Mimikatz and PowerShell for credential theft, and AnyDesk for persistent remote access. Their tooling also supports privilege escalation, lateral movement, tunneling, and pivoting. Stolen information is commonly compressed with 7-Zip and transferred using FileZilla, FTP, rclone, and cloud storage services; individual thefts have exceeded one terabyte. Known ransom demands have ranged from $25,000 to $13 million in Bitcoin, typically with deadlines of approximately one week. Operators intensify pressure through repeated calls and emails to employees, clients, and business partners, often distributing samples of sensitive stolen information. Karakurt has also pursued renewed extortion against previously attacked organizations. Payment does not reliably ensure confidentiality or deletion of stolen data.