KarakurtThreat actor
- karakurt lair
Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors have claimed to steal data and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
Targets countriesCanada, Germany, United Kingdom, United StatesMISP Galaxy
What the reports say
1 report, newest first · the exact sentence from each-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“IcedID was detected in attacks involving the following ransomware groups: Karakurt, RansomEXX, Black Basta, Nokoyawa, Quantum, REvil, Xingteam, and Conti.”
Indicators in its reports
named in the reports above- anbush[.]comin 1 report
- mysqlserver[.]orgin 1 report
- ipulsecloud[.]comin 1 report
- esoftwareupdates[.]comin 1 report
- cmdatabase[.]comin 1 report
- maximumservers[.]netin 1 report
- avdev[.]netin 1 report
- devcloudpro[.]comin 1 report
- uranustechsolution[.]comin 1 report
- qw.sveexec[.]comin 1 report
- situotech[.]comin 1 report
- 1ca4cbac895fc3bd12417b77fc6ed31din 1 report
- 194.165.16[.]64in 1 report
- 46.161.27[.]151in 1 report
- 193.142.30[.]37in 1 report
- 193.142.30[.]205in 1 report
- 81.19.135[.]229in 1 report
- 194.165.16[.]53in 1 report
- 5.188.87[.]47in 1 report
- 194.165.16[.]90in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.