KARAKURT

Karakurt is a financially motivated threat actor assessed by multiple cybersecurity firms and US government agencies to be a subsidiary or affiliated extortion arm of the now-defunct Conti ransomware operation , one of the most prolific and damaging ransomware groups in history. Karakurt emerged as a distinct entity in late 2021, operating with a distinctive methodology that differentiates it from typical ransomware operators: the group focuses exclusively on data theft and extortion without deploying file-encrypting ransomware.

This "data theft only" approach offers several tactical advantages , it avoids triggering ransomware-specific detection tools, reduces the complexity of operations, and creates a different extortion dynamic where victims must weigh the reputational and regulatory consequences of data publication rather than the immediate operational impact of encrypted systems. Karakurt demands ransoms typically ranging from $25,000 to $13 million USD.

US government advisories from CISA, the FBI, and the US Treasury Department confirmed Karakurt's links to the Conti ecosystem, noting shared infrastructure, cryptocurrency wallets, and personnel with Conti and the Diavol ransomware operation. Following Conti's public implosion in mid-2022 , triggered by the leak of the group's internal communications after Conti expressed support for Russia's invasion of Ukraine , Karakurt continued operating as one of several successor entities.

Karakurt has targeted hundreds of organisations across healthcare, financial services, technology, and manufacturing sectors in North America and Europe. Their initial access methods include exploitation of known vulnerabilities and purchase of access from initial access brokers operating in criminal marketplaces, consistent with Conti's established operational practices.

Tactical Telemetry and Extortion Framework: In confirmed intrusions, Karakurt employs double-extortion tactics, combining high-speed asymmetric encryption with automated data exfiltration pipelines. Initial access is routinely obtained via compromised Remote Desktop Protocol (RDP) credentials, initial access broker (IAB) marketplaces, and spear-phishing campaigns delivering infostealer payloads. Organizations operating critical IT infrastructure are advised to enforce strict network segmentation, deploy hardware-backed multi-factor authentication across all external access points, and maintain immutable offline backups to mitigate operational disruption.