Skip to main content
Darkfield

Operator dossier

Karakurt is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 74 public victims claimed by this operator between December 11, 2022 and September 22, 2023. Karakurt is a ransomware group that emerged in December 2022, operating primarily as a data extortion threat actor with financial motivations rather than traditional file encryption. The group's origin and affiliations remain largely undocumented by major cybersecurity agencies, though their operational patterns suggest they function as an independent entity rather than a confirmed ransomware-as-a-service operation. Karakurt employs data theft and extortion tactics, focusing on exfiltrating sensitive information from victim networks before demanding payment under threat of public disclosure, representing a pure extortion model that bypasses traditional encryption-based ransomware approaches. The group has targeted 74 known victims across multiple sectors, with particular focus on healthcare, education, manufacturing, energy, and professional services organizations, primarily affecting entities in the United States, United Kingdom, Germany, Singapore, and India. Based on available reporting from established cybersecurity agencies and researchers, Karakurt appears to remain active as of recent assessments, though comprehensive intelligence on their specific attack vectors, tools, and major campaigns remains limited in publicly documented sources from CISA, FBI, and major security research organizations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Karakurt

All 74 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Karakurt →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Karakurt

74 victims indexed · first seen 4 years ago · last activity 3 years ago

74
Victims indexed
#89 of 364 tracked operators
9m
Active period
Dec 2022 → Sep 2023
6
Countries hit
top United States · 5

At a glance

Status
inactive
First seen
4 years ago
Last activity
3 years ago
Onion sites
5 known endpoints
Primary sector
Healthcare · 6 hits

About

Karakurt is a ransomware group that emerged in December 2022, operating primarily as a data extortion threat actor with financial motivations rather than traditional file encryption. The group's origin and affiliations remain largely undocumented by major cybersecurity agencies, though their operational patterns suggest they function as an independent entity rather than a confirmed ransomware-as-a-service operation. Karakurt employs data theft and extortion tactics, focusing on exfiltrating sensitive information from victim networks before demanding payment under threat of public disclosure, representing a pure extortion model that bypasses traditional encryption-based ransomware approaches. The group has targeted 74 known victims across multiple sectors, with particular focus on healthcare, education, manufacturing, energy, and professional services organizations, primarily affecting entities in the United States, United Kingdom, Germany, Singapore, and India. Based on available reporting from established cybersecurity agencies and researchers, Karakurt appears to remain active as of recent assessments, though comprehensive intelligence on their specific attack vectors, tools, and major campaigns remains limited in publicly documented sources from CISA, FBI, and major security research organizations.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

9 months
2022-12-01T00:00:00+00:00 · 432023-01-01T00:00:00+00:00 · 12023-03-01T00:00:00+00:00 · 42023-04-01T00:00:00+00:00 · 112023-05-01T00:00:00+00:00 · 32023-06-01T00:00:00+00:00 · 52023-07-01T00:00:00+00:00 · 32023-08-01T00:00:00+00:00 · 22023-09-01T00:00:00+00:00 · 2
2022-12-01T00:00:00+00:002023-09-01T00:00:00+00:00

Top countries

🇺🇸 United States
5
🇬🇧 United Kingdom
1
🇩🇪 Germany
1
🇸🇬 Singapore
1
🇮🇳 India
1
🇻🇳 Vietnam
1
United States dossier →United Kingdom dossier →Germany dossier →Singapore dossier →

Top sectors

Healthcare
6
Education
5
Manufacturing
1
Energy
1
Professional Services
1
Healthcare dossier →Education dossier →Manufacturing dossier →Energy dossier →

MITRE ATT&CK

9 techniques · 9 tactics

Tactics

Initial AccessExecutionPersistenceDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1543Create or Modify System Process
  • T1562Impair Defenses
  • T1003OS Credential Dumping
  • T1021Remote Services
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

5 known
  • http://3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion
  • http://karaleaks.com
  • http://omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion
  • https://3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion
  • https://omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Karakurt posts a victim.

Add Karakurt to your watchlist — Pro pings you within 5 minutes of any new Karakurt leak-site post, Telegram callout, or affiliate-rebrand inference.