[CDP-development] CISA Joint Advisory: Karakurt Data Extortion Group - TLP:WHITE

[Masse, Theresa]

FYSA

CISA, the Federal Bureau of Investigation (FBI), the Department of the Treasury (Treasury), and the Financial Crimes Enforcement Network (FinCEN) have released a (TLP:WHITE) joint Cybersecurity Advisory: Karakurt Data Extortion Group<https://www.cisa.gov/uscert/ncas/alerts/aa22-152a>.

This advisory provides information on the Karakurt data extortion group, also known as the Karakurt Team and Karakurt Lair. Karakurt actors have employed a variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors have claimed to steal data and threatened to auction it off or release it to the public unless they receive payment of the demanded ransom. Known ransom demands have ranged from $25,000 to $13,000,000 in Bitcoin, with payment deadlines typically set to expire within a week of first contact with the victim.

Karakurt actors have typically provided screenshots or copies of stolen file directories as proof of stolen data. Karakurt actors have contacted victims’ employees, business partners, and clients with harassing emails and phone calls to pressure the victims to cooperate. The emails have contained examples of stolen data, such as social security numbers, payment accounts, private company emails, and sensitive business data belonging to employees or clients. Upon payment of ransoms, Karakurt actors have provided some form of proof of deletion of files and, occasionally, a brief statement explaining how the initial intrusion occurred.

Prior to January 5, 2022, Karakurt operated a leaks and auction website found at https://karakurt[.]group<https://urldefense.us/v3/__https:/karakurt*.*group__;W10!!BClRuOV5cvtbuNI!U12ro38ppWpaeGqO9wqy8sve2TPSw-EFp6bqhaYEd70v0uSUITDrYJ6_eyIfHxx8GiYpCeU$>. The domain and IP address originally hosting the website went offline in the spring 2022. The website is no longer accessible on the open internet, but has been reported to be located elsewhere in the deep web and on the dark web. As of May 2022, the website contained several terabytes of data purported to belong to victims across North America and Europe, along with several “press releases” naming victims who had not paid or cooperated, and instructions for participating in victim data “auctions.”

CISA Recommendations:

  *   Review the joint CSA<https://www.cisa.gov/uscert/ncas/alerts/aa22-152a>, including technical details and indicators of compromise, and apply the mitigation recommendations

We kindly request any incidents or anomalous activity be reported to CISA at https://us-cert.cisa.gov/report, report at cisa.gov<mailto:report at cisa.gov>, or (888) 282-0870 and/or to the FBI via your local FBI field office<https://urldefense.us/v3/__https:/www.fbi.gov/contact-us/field-offices__;!!BClRuOV5cvtbuNI!U12ro38ppWpaeGqO9wqy8sve2TPSw-EFp6bqhaYEd70v0uSUITDrYJ6_eyIfHxx8PaKQJNQ$> or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch at fbi.gov<mailto:CyWatch at fbi.gov>.


Theresa A. Masse
Cyber Security Advisor, Region 10 (Oregon)
Cybersecurity and Infrastructure Security Agency
Department of Homeland Security
Phone: (503) 930-5671
Email: theresa.masse at cisa.dhs.gov<mailto:theresa.masse at cisa.dhs.gov>

[cid:image007.png at 01D8759F.E08349E0]


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://omls.oregon.gov/pipermail/cdp-development/attachments/20220601/37029146/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image007.png
Type: image/png
Size: 16152 bytes
Desc: image007.png
URL: <https://omls.oregon.gov/pipermail/cdp-development/attachments/20220601/37029146/attachment-0001.png>