malware family

Karakurt

unknownentity:malware_familyransomware · 1 source

Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors have claimed to steal data and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom. Known ransom demands have ranged from $25,000 to $13,000,000 in Bitcoin, with payment deadlines typically set

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: karakurt
kind: malware family
status: unknown
aliases: Karakurt Lair
jurisdictions: —
claims naming it: 45 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 035fbd5c-e4a1-4c7b-80fb-f5a89a361aedvia misp-galaxy-threat-actor
misp-galaxy a7623a1b-4551-4e5a-a622-2b91dea16b42via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 45

Karakurtransomwarepayment
subjecttransactione991fe0690…3488c7fdc4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qq9ryhutrprmehapvksmefcr97z2sk3kdycpqtr · 222,553,725 sat · time 2022-01-27 18:23 UTC · url https://ransomwhe.re/#address/bc1qq9ryhutrprmehapvksmefcr97z2sk3kdycpqtr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26359btcintel:annotations:26359@v3 sha256:9aa9fb17477a9121
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qq9ryhutrprmehapvksmefcr97z2sk3kdycpqtr
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qq9ryhutrprmehapvksmefcr97z2sk3kdycpqtr
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26358btcintel:annotations:26358@v2 sha256:c9dfac079f84a1cd
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction4288155b5a…4b89e8bd99
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qj7aksdmgrnvf4hwjcm5336wg8pcmpegvhzfmhw · 314,900,004 sat · time 2022-01-05 22:03 UTC · url https://ransomwhe.re/#address/bc1qj7aksdmgrnvf4hwjcm5336wg8pcmpegvhzfmhw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26357btcintel:annotations:26357@v3 sha256:6b1a539c1d05cc06
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qj7aksdmgrnvf4hwjcm5336wg8pcmpegvhzfmhw
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qj7aksdmgrnvf4hwjcm5336wg8pcmpegvhzfmhw
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26356btcintel:annotations:26356@v2 sha256:68b4dfcdeb75e0fa
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransactiondfc4529124…9c788b061b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq · 179,568,491 sat · time 2021-12-13 20:32 UTC · url https://ransomwhe.re/#address/bc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26355btcintel:annotations:26355@v3 sha256:230cc9b2095be8c3
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction8ad008200c…dd1836c7e3
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq · 106,125,838 sat · time 2021-12-29 20:09 UTC · url https://ransomwhe.re/#address/bc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26354btcintel:annotations:26354@v3 sha256:74dd98ca1358c71e
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qrtq27tn34pvxaxje4j33g3qzgte0hkwshtq7sq
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26353btcintel:annotations:26353@v2 sha256:8a7c7705a848cb91
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction7c1fa6c17f…06e08478f6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qqp73up3xff6jz267n7vm22kd4p952y0mhcd9c8 · 57,252,148 sat · time 2021-10-19 17:16 UTC · url https://ransomwhe.re/#address/bc1qqp73up3xff6jz267n7vm22kd4p952y0mhcd9c8
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26352btcintel:annotations:26352@v3 sha256:c1b7dd23377b46cd
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qqp73up3xff6jz267n7vm22kd4p952y0mhcd9c8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qqp73up3xff6jz267n7vm22kd4p952y0mhcd9c8
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26351btcintel:annotations:26351@v2 sha256:2ec130fd77730405
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction53091c962f…3b64a8a74d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qxfqe0l04cy4qgjx55j4qkkm937yh8sutwhlp4c · 239,200,000 sat · time 2022-01-07 19:02 UTC · url https://ransomwhe.re/#address/bc1qxfqe0l04cy4qgjx55j4qkkm937yh8sutwhlp4c
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26350btcintel:annotations:26350@v3 sha256:b4668f499d04ad7d
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qxfqe0l04cy4qgjx55j4qkkm937yh8sutwhlp4c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qxfqe0l04cy4qgjx55j4qkkm937yh8sutwhlp4c
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26349btcintel:annotations:26349@v2 sha256:69484a9c164a686a
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction53babe1b8a…21d16ae075
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp · 7,330 sat · time 2021-11-03 23:09 UTC · url https://ransomwhe.re/#address/bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26348btcintel:annotations:26348@v3 sha256:d0e359c4a0f403e6
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction442d999365…d13fc1b198
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp · 405,978,124 sat · time 2021-11-04 19:17 UTC · url https://ransomwhe.re/#address/bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26347btcintel:annotations:26347@v3 sha256:c630acf7e9b9706b
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hp
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26346btcintel:annotations:26346@v2 sha256:5d3a57a8bd71cf2c
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction8f3d29285d…cc92666e1c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qrkcjtdjccpy8t4hcna0v9asyktwyg2fgdmc9al · 519,685,000 sat · time 2022-02-23 02:25 UTC · url https://ransomwhe.re/#address/bc1qrkcjtdjccpy8t4hcna0v9asyktwyg2fgdmc9al
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26345btcintel:annotations:26345@v3 sha256:f7146cc547d88543
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qrkcjtdjccpy8t4hcna0v9asyktwyg2fgdmc9al
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qrkcjtdjccpy8t4hcna0v9asyktwyg2fgdmc9al
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26344btcintel:annotations:26344@v2 sha256:1a3492d12f0db8db
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction62368745c6…3ac16f91a4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qz9a0nyrqstqdlr64qu8jat03jx5smxfultwpm0 · 634,589,315 sat · time 2022-03-05 00:33 UTC · url https://ransomwhe.re/#address/bc1qz9a0nyrqstqdlr64qu8jat03jx5smxfultwpm0
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26343btcintel:annotations:26343@v3 sha256:f35198dd15ece64b
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1qz9a0nyrqstqdlr64qu8jat03jx5smxfultwpm0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1qz9a0nyrqstqdlr64qu8jat03jx5smxfultwpm0
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26341btcintel:annotations:26341@v2 sha256:d2debcf0f84447c9
confidencetrusted provider · 50
Karakurtransomwarepayment
subjecttransaction0c515944f7…a3e311c074
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q3xgr4z53cdaeyn03luhen24xu556y5spvyspt8 · 441,000,000 sat · time 2022-02-02 18:49 UTC · url https://ransomwhe.re/#address/bc1q3xgr4z53cdaeyn03luhen24xu556y5spvyspt8
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_26340btcintel:annotations:26340@v3 sha256:a6b20e6dd53356a8
confidencetrusted provider · 50
Karakurtransomwarepayment address
subjectaddressbc1q3xgr4z53cdaeyn03luhen24xu556y5spvyspt8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Karakurt · url https://ransomwhe.re/#address/bc1q3xgr4z53cdaeyn03luhen24xu556y5spvyspt8
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_26339btcintel:annotations:26339@v2 sha256:467c70d617ffda8b
confidencetrusted provider · 50

Subjects45 subjects carry a claim naming this entity · a sample

bc1q25km8usscsra6w2falmtt7wxyga8tnwd5s870gaddress
bc1q3xgr4z53cdaeyn03luhen24xu556y5spvyspt8address
bc1q6s0k4l8q9wf3p9wrywf92czrxaf9uvscyqp0fuaddress
bc1q8ff3lrudpdkuvm3ehq6e27nczm393q9f4ydlgtaddress
bc1qa5v6amyey48dely2zq0g5c6se2keffvnjqm8msaddress
bc1qenjstexazw07gugftfz76gh9r4zkhhvc9eeh47address
bc1qfp3ym02dx7m94td4rdaxy08cwyhdamefwqk9hpaddress
bc1qj7aksdmgrnvf4hwjcm5336wg8pcmpegvhzfmhwaddress
bc1qq427hlxpl7agmvffteflrnasxpu7wznjsu02ncaddress
bc1qq9ryhutrprmehapvksmefcr97z2sk3kdycpqtraddress

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.