{
  "name": "Unleashing the Kraken ransomware group",
  "slug": "unleashing-the-kraken-ransomware-group",
  "description": "The Kraken ransomware group, emerging from the remnants of the HelloKitty cartel, has been observed conducting big-game hunting and double extortion attacks. Utilizing SMB vulnerabilities for initial access, they employ tools like Cloudflared for persistence and SSHFS for data exfiltration. Kraken's cross-platform ransomware targets Windows, Linux, and VMware ESXi environments, featuring a unique benchmarking capability. The group operates a data leak site and has announced a new underground forum called 'The Last Haven Board'. Kraken's sophisticated ransomware includes extensive command-line options, encryption performance testing, and anti-analysis techniques. It targets various file types, including SQL databases and network shares, while employing multi-threaded encryption and self-deletion processes to evade detection.",
  "published": "2025-11-13T17:04:27+00:00",
  "created_at": "2025-11-13T17:04:27+00:00",
  "modified_at": "2025-11-13T19:16:19+00:00",
  "created_at_opencti": "2025-11-13T17:04:27+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-11-13",
    "cross-platform",
    "data leak",
    "double-extortion",
    "encryption",
    "kraken",
    "ransomware",
    "russian-speaking",
    "underground forum"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a"
      },
      {
        "id": "",
        "name": "f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965"
      },
      {
        "id": "",
        "name": "abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8"
      },
      {
        "id": "",
        "name": "79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2"
      },
      {
        "id": "",
        "name": "7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3"
      },
      {
        "id": "",
        "name": "32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218"
      },
      {
        "id": "",
        "name": "340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7"
      },
      {
        "id": "",
        "name": "2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d"
      },
      {
        "id": "",
        "name": "2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86"
      },
      {
        "id": "",
        "name": "2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9"
      },
      {
        "id": "",
        "name": "1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523"
      }
    ],
    "malware": [
      {
        "id": "0606de30-6ea0-4589-9ac1-8eb52fb4520b",
        "name": "Kraken",
        "slug": "kraken"
      }
    ],
    "intrusion_sets": [
      {
        "id": "cc7f60cb-b85d-48cb-baff-c36ff94bd578",
        "name": "Kraken",
        "slug": "kraken"
      }
    ],
    "attack_patterns": [
      {
        "id": "f65930b0-5581-4f3d-a367-a86ac78f407b",
        "name": "T1021.004"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "7911f1c3-e86b-4e33-afea-9a054b0295dc",
        "name": "T1222"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Kuwait"
      },
      {
        "id": "",
        "name": "Panama"
      },
      {
        "id": "",
        "name": "Denmark"
      },
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "United States of America"
      }
    ]
  },
  "external_refs": [
    "https://blog.talosintelligence.com/kraken-ransomware-group/",
    "https://otx.alienvault.com/pulse/69161dab29c1fb1dc04a0b05"
  ]
}