Threat actor · all actors
KarakurtMISP-035fbd5c criminal
aka Karakurt, Karakurt Lair
Last updated: 2026-10-16
About this actor
Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors have claimed to steal data and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom. Known ransom demands have ranged from $25,000 to $13,000,000 in Bitcoin, with payment deadlines typically set to expire within a week of first contact with the victim.
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- No ATT&CK techniques mapped.
- Named victims
- None on file.
Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.
See how actor data is built for the full pipeline.
Activity timeline
- 2021 — 1 CVE published, 1 KEV added
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-44228 KEV | 10.0 | 10.0 | 1.0000 | 2021-12-10 | see CVE |
No techniques attributed.
Co-occurring actors
- COMP-MICROSOFT-SALESFORCE 1 shared CVEs
- l group 1 shared CVEs
- Storm-0530 1 shared CVEs
- eCh0raix 1 shared CVEs
- HiddenTear 1 shared CVEs
- HAFNIUM 1 shared CVEs
- Maui ransomware 1 shared CVEs
- Deep Panda 1 shared CVEs
- AnonOps 1 shared CVEs
- COMP-APPLE-MASIMO 1 shared CVEs
Similar actors
Overlapping CVEs
- COMP-SK-INNOVATION 0.33
- HiddenTear 0.33
- Evil Ransomware 0.33
- Daixin Team 0.33
- 0day 0.33
Active in same years
Same category
- LAPSUS$ 1.00
- Akira 1.00
- INC Ransom 1.00
- Play 1.00
- BlackByte 1.00