CISA Alert AA22-152A – Karakurt data extortion group.
·3 min
The episode is a CISA cybersecurity alert about the Karakurt data extortion group, released on June 1, 2022. It begins by introducing Karakurt, also known as the Karakurt Team and Karakurt Layer. The alert explains that Karakurt actors use various tactics, techniques, and procedures (TTPs) to create significant defense challenges. Karakurt claims to steal data and threatens to auction or release it publicly unless paid. Known extortion demands range from $25,000 to $13 million in Bitcoin, with payment deadlines typically expiring within a week of first contact. To prove stolen data, Karakurt provides screenshots or copies of file directories. The group pressures victims by contacting employees, business partners, and clients with harassing emails and phone calls. These emails contain examples of stolen data, such as social security numbers, payment accounts, private company emails, and sensitive business data. As of May 2022, Karakurt's website contained several terabytes of data purported to belong to victims across North America and Europe. The website also included press releases naming victims who had not paid and instructions for participating in data auctions. Karakurt does not appear to target any specific sectors, industries, or types of victims. During reconnaissance, Karakurt actors obtain access to victim data primarily by purchasing stolen login credentials through cooperating partners in the cybercrime community. They also buy access to already compromised victims through third-party intrusion brokers. The full report linked in the show notes includes indicators of compromise (IOCs), common initial access vulnerabilities used by Karakurt, extortion techniques, a full MITRE ATT&CK mapping for this adversary playbook, mitigation strategies, and links to additional security resources. The episode is presented by the Cyber Wire Network, powered by N2K Networks, as a public service.
