Ransomware group profile · #82 by claimed victims

Karakurt ransomware

Karakurt is a pure data-extortion group (no encryption) assessed with high confidence to be the extortion arm of the Conti ransomware group, active from 2021, that steals data and threatens to auction or publish it unless ransoms ranging from $25,000 to $13 million are paid.

Active First seen Dec 2022

74Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

4Countries hit

9Leak-site URLs tracked, 0 online

22 Sep 2023Latest claim recorded

Victimology

Who Karakurt claims to have breached, from 74 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare20

Manufacturing10

Education7

Professional Services6

Retail & E-Commerce5

Financial Services4

Hospitality3

Technology3

Top countries

United States5

Singapore1

India1

Vietnam1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Hospice of Huntington hospiceofhuntington.org	Healthcare	—	22 Sep 2023
Yakima Valley Radiology	Healthcare	—	22 Sep 2023
Valley Mountain Regional Center vmrc.net	Healthcare	—	31 Aug 2023
COSI cosi.org	Education	—	2 Aug 2023
McAlester Regional Health Center mcalesterregional.com	Healthcare	—	28 Jul 2023
Regional Family Medicine	Healthcare	—	28 Jul 2023
Jefferson County Health Center	Healthcare	—	3 Jul 2023
CentroMed centromedsa.com	Healthcare	—	28 Jun 2023
Pan Pacific Hotels Group panpacific.com	Hospitality	SG	28 Jun 2023
Reeds Spring School District rssd.k12.mo.us	Education	—	26 Jun 2023
Eastside Union School District eusd.org	Education	—	21 Jun 2023
Beacon ABA Services	Healthcare	—	5 Jun 2023

All 74 Karakurt victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Karakurt is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Karakurt ransomware still active?

Karakurt is tracked as active. The most recent leak-site claim VULONE recorded is dated 22 September 2023.

How many victims has Karakurt claimed?

VULONE has recorded 74 leak-site victim claims attributed to Karakurt since December 2022, across 4 countries and 14 sectors.

Which industries does Karakurt target?

The sectors most often named on the Karakurt leak site are Healthcare, Manufacturing, Education.

Which countries are most affected by Karakurt?

Most Karakurt victims recorded by VULONE are located in United States, Singapore, India.

Where does VULONE get Karakurt victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].