Loading story…
Researchers and incident responders tied the Karakurt data extortion group to the Conti ransomware syndicate, concluding that both operated as parts of the same criminal enterprise. Infinitum IT reported access to Conti infrastructure, including a VPS holding more than 20TB of stolen victim data, and said it found technical links between a Conti operator and Karakurt systems through FileZilla connections and recovered SSH credentials. The findings indicate Karakurt was used in intrusions where attackers stole data but did not successfully deploy ransomware encryption.
Independent analysis from Arctic Wolf and Chainalysis supported the connection through incident response evidence and cryptocurrency tracing, pointing to shared infrastructure and financial flows between the two groups. The reporting said Karakurt hit more than 40 organizations over roughly two months in late 2021, reinforcing that the operation functioned as a dedicated extortion arm for Conti to monetize breaches through data theft and leak threats even when ransomware execution failed.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Infinitum IT released a CTI note publishing indicators of compromise and infrastructure allegedly tied to Karakurt, including command-and-control, data storage, and leak-site systems. The disclosure also described observed use of Ligolo-ng for SOCKS proxy pivoting and identified associated Ligolo-ng and Cobalt Strike infrastructure.
Infinitum IT reported evidence that the Conti ransomware syndicate and the Karakurt data extortion group were part of the same criminal operation, and Arctic Wolf independently supported the link. The public reporting also described Karakurt as a monetization path for attacks where data theft succeeded but ransomware encryption did not.
When the Conti leaks began, Infinitum IT said it gained access to multiple ProtonMail and Mega accounts used by a key Conti member. Those compromised accounts allegedly contained credentials and emails that enabled access to Conti infrastructure.
The reporting says Karakurt victimized more than 40 organizations over roughly two months in late 2021. The explicitly anchored period given is between September and November 2021.
The references state that Karakurt had been active since at least June 2021, focusing on stealing data and extorting victims by threatening to publish it rather than deploying encryption.
Chainalysis found that several Karakurt wallets sent cryptocurrency to wallets controlled by Conti and that Karakurt victim payment addresses were hosted by a Conti wallet. These blockchain findings supported the conclusion that the two operations shared management and financial flows.
Arctic Wolf reported that a client that had previously paid Conti was later breached by Karakurt through a Cobalt Strike backdoor left behind by Conti. The finding was part of joint research with Tetra Defense, Northwave, and Chainalysis across more than a dozen Karakurt incidents.
Infinitum IT reported obtaining SSH credentials for Karakurt's command-and-control server by exploiting an unpatched FileZilla vulnerability and recovering an SSH private key for the TOR leak site server. It said this allowed full compromise of Karakurt infrastructure, including access to the C2 server and attack tools.
Using credentials recovered from the compromised accounts, Infinitum IT said it accessed an internal Conti VPS server hosted by Inferno Solutions. The server reportedly contained more than 20TB of stolen victim data, including data tied to undisclosed victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcearcticwolf.com
Open sourcebleepingcomputer.com
Open sourceinfinitumit.com.tr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conti emerged as one of the most active **ransomware-as-a-service** operations, using spearphishing, exposed `RDP`, and loaders such as **BazarLoader**, **TrickBot**, **IceID**, and **Emotet** to gain access before deploying **Cobalt Strike**, stealing data, and encrypting systems across networks. Security reporting tied the group to more than 400 attacks globally, with victims concentrated in North America and Europe, and described technical tradecraft including credential attacks, shadow copy deletion, service termination, remote `SMB` encryption, and ransom notes named `CONTI_README.txt`. In industrial environments, Dragos said ransomware became the leading cause of compromises in 2021, with **Conti** and **LockBit 2.0** accounting for more than half of observed incidents, while suspected Conti-linked activity was later detected at major automotive manufacturers and suppliers in North America and Japan. Leaked internal chats, source code, and infrastructure data exposed Conti as a highly organized criminal business rather than a loose affiliate network. Researchers identified a core group of roughly 44 members within a wider set of 442 chat handles, with dedicated teams for coding, reverse engineering, OSINT, HR, payroll, and a "**Fire Team**" that conducted victim research, built phishing phone and email scripts, and helped pressure victims during ransom negotiations using tools such as **Shodan**, **SpiderFoot**, **SignalHire**, and **ZoomInfo**. The group’s impact was illustrated by the attack on Ireland’s **Health Service Executive**, where about **80%** of IT systems were encrypted, roughly **700 GB** of data was stolen, and healthcare services were disrupted nationwide before Conti offered a free decryptor while still demanding a **$20 million** ransom and threatening to leak the data.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
The **Conti** ransomware syndicate took key parts of its digital infrastructure offline, including sections of its leak site, victim negotiation portal, and internal systems, in what researchers described as a deliberate reorganization rather than a direct law-enforcement takedown. Security firms and reporting tied the move to mounting pressure after a pro-Ukraine insider leaked Conti’s internal chats and tools, exposing the group’s structure, workflows, and links to Russia. The leaks followed Conti’s public declaration of support for Russia after the invasion of Ukraine, a stance that triggered internal backlash and gave investigators an unusually detailed view into one of the world’s most prolific ransomware operations. Researchers said Conti’s shutdown did not mark the end of its activity but a **rebranding and dispersal of personnel** into smaller, harder-to-track units and other extortion groups, including operations such as **ALPHV/BlackCat**. Subsequent reporting indicated former Conti members continued to repurpose the gang’s tooling in campaigns tied to Ukraine, including lures exploiting the **Follina** vulnerability and impersonation themes involving Elon Musk. The episode also underscored why sanctions and disruption efforts struggle to permanently dismantle ransomware groups: even when a major brand collapses, its operators, malware, and playbooks often persist across successor crews.
Jun 29, 2026