Chort is a recently emerged ransomware group that first appeared in November 2024, operating with apparent financial motivations based on their targeting patterns across multiple sectors. Given the group's recent emergence and limited public documentation, their country of origin and potential affiliations remain unclear, though their targeting of US and Kuwaiti entities suggests a broader international operational scope rather than localized cybercriminal activity. The group's attack methodology details have not been extensively documented by major security firms, though their sector-specific targeting of education, agriculture and food production, technology, and government entities indicates a deliberate victim selection process rather than opportunistic attacks. With only seven known victims documented since their November 2024 emergence, Chort has maintained a relatively low profile compared to established ransomware operations, with no major high-profile incidents or law enforcement actions publicly reported by CISA, FBI, or prominent security researchers. The group remains active as of late 2024, though their limited victim count and recent emergence make it unclear whether they represent a nascent operation still developing their capabilities or a more selective targeting approach. The group has been linked to 7 public disclosures across our corpus. First observed on a leak site on November 17, 2024; most recent post November 22, 2024. The operation is currently inactive.
Sector and geography
This disclosure adds to ransomware activity in the Education sector, which has 694 disclosures indexed across all operators we track. Geographically, hartwick.edu is reported in United States, a country with 7,392 ransomware disclosures in our corpus.
How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.
