THREAT ACTOR
KARAKURT_
DormantKARAKURT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KARAKURT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
108
Victims tracked
0 / 10
Active mirrors
2022-08-18
First listing
2023-09-22
Most recent
Victims by year
- 2023 32
- 2022 76
Leak site mirrors
10 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onionMagazine snapshot · 2024-08-02 08:03 -
www.karanews.livesnapshot · 2023-06-16 14:02 -
www.karanews.livesnapshot · 2023-06-16 14:02 -
karakurt.tech403 Forbidden snapshot · 2025-03-29 00:04 -
karaleaks.comsnapshot · 2026-09-08 04:29 -
omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onionsnapshot · 2024-12-10 04:31 -
53dxw3yoeirahqn263a7ihzv2hhsjzdgvwqxdcuujlsrctmqzsph6tid.onionsnapshot · 2024-12-11 09:48 -
jo7jezin3bmprlivyleqfv7rq3j4m36hd7bf2bguabxf2rlyrvrjwhad.onionsnapshot · 2024-12-11 09:48 -
nrulhk2lbzt7jw6tnsq6gkjrn37j7uwfu5oxbuxezgherhuhakl2tqid.onionsnapshot · 2024-12-11 09:48 -
t5sb509msc3q4ls06o1g8e4egfxl1o7e79yvlldakfphc0nf7rwiyphv.onionsnapshot · 2024-12-12 15:22
Recent victims
The 50 most recent victims claimed by KARAKURT. Total in the index: 108.
| Date listed | Victim | Description |
|---|---|---|
| 2023-09-22 | Hospice of Huntington | Hospice of Huntington, Inc. is the first hospice in the State of West … |
| 2023-09-22 | Yakima Valley Radiology | Yakima Valley Radiology PC is a company that operates in the Hospital … |
| 2023-08-31 | Valley Mountain Regional Center | Valley Mountain Regional Center is a private company that serves child… |
| 2023-08-30 | Goodwill industries | Goodwill was founded in Boston by Reverend Edgar J. Helms, a Methodist… |
| 2023-08-02 | COSI | COSI, Columbus, Ohio's dynamic Center of Science and Industry, inspire… |
| 2023-07-28 | Regional Family Medicine | Regional Family Medicine is a primary care group comprised of two sepa… |
| 2023-07-28 | McAlester Regional Health Center | Founded in 1978, McAlester Regional Health Center is devoted to a cont… |
| 2023-07-03 | Jefferson County Health Center | Jefferson County Hospital, Waurika, Oklahoma, is a 25-bed critical acc… |
| 2023-06-28 | CentroMed | El Centro del Barrio (CDB), which started doing business as CentroMed … |
| 2023-06-28 | Pan Pacific Hotels Group | Pan Pacific Hotels Group is a wholly-owned hotel subsidiary of Singapo… |
| 2023-06-26 | Reeds Spring School District | Gibson Technical Center is a career and technical education school tha… |
| 2023-06-21 | Eastside Union School District | Eastside Union School District seeks to provide an inclusive, challeng… |
| 2023-06-05 | Beacon ABA Services | Beacon ABA Services, Inc. is a private group practice of behavior anal… |
| 2023-05-23 | Chattanooga Heart Institute | The Chattanooga Heart Institute at Memorial offers a comprehensive mul… |
| 2023-05-15 | York County School of Technology | York County School of Technology offers educational opportunities wher… |
| 2023-05-12 | Peachtree Orthopedics | Since 1953, Peachtree Orthopedics has been serving the orthopedic need… |
| 2023-04-29 | Our Sunday Visitor | Our Sunday Visitor is a Catholic publisher serving millions of Catholi… |
| 2023-04-27 | La Red Health Center | La Red Health Center provides an outreach programs help reach undeserv… |
| 2023-04-24 | Lifeline Vascular Access | Lifeline Vascular Access provides management services that streamline … |
| 2023-04-24 | TransMedics | TransMedics, Inc., a medical device company, develops and provides por… |
| 2023-04-24 | Winona Powder Coating | Winona Powder Coating is the largest provider of finishing services in… |
| 2023-04-21 | Wynn-Reeth | Wynn-Reeth provides services to the client which will help the individ… |
| 2023-04-18 | Ozarks Community Hospital | Founded in 1930 the Ozarks Community Hospital (OCH) of Gravette, AR is… |
| 2023-04-17 | Pharm-Pacc Corporation | Pharm-Pacc Corporation is a provider of Managed Recovery Services to h… |
| 2023-04-12 | Petaluma Health Center | The Petaluma Health Center is a Federally Qualified Health Center that… |
| 2023-04-12 | Medicalodges, Inc | Founded in 1961, Medicalodges is a provider of healthcare services. Me… |
| 2023-04-06 | Officeworks Inc | Officeworks Inc, has shared with us some of their employees with addre… |
| 2023-03-31 | OptionMetrics | OptionMetrics provides its customers with databases of various busines… |
| 2023-03-29 | FINANCE INSTITUTION AUCTION | We're happy to present you a brilliant 4TB stolen from a microfinance … |
| 2023-03-28 | MICROFINANCE INSTITUTION | We're happy to present you a brilliant 4TB stolen from a microfinance … |
| 2023-03-20 | National Board of Osteopathic Medical Examiners | The National Board of Osteopathic Medical Examiners (NBOME) is an inde… |
| 2023-01-09 | River City Science Academy | River City Science Academy (RCSA) is a tuition-free, public charter sc… |
| 2022-12-16 | TLC | TLC is a global brand available in more than 84 million homes in the U… |
| 2022-11-21 | Schrader-Pacific International | Schrader-Bridgeport International is a company that operates in the Au… |
| 2022-11-21 | Stratus | Stratus is a nationwide brand implementation company serving some of t… |
| 2022-11-17 | *СH*****-*A**F** International | A company operates in the Automotive industry. It employs 100-250 peop… |
| 2022-11-16 | *С******-****F** International | A company operates in the Automotive industry. It employs 100-250 peop… |
| 2022-11-15 | ********-******* International | A company operates in the Automotive industry. It employs 100-250 peop… |
| 2022-11-09 | BauVal | BauVal was founded in 1954 on the South Shore of Montreal and was firs… |
| 2022-11-09 | Centrisys cnp | Centrisys is a USA manufacturer of decanter centrifuges for sludge dew… |
| 2022-11-09 | Roxboro | Roxboro company operates in the construction industry. The company off… |
| 2022-11-01 | Urban | Urban began as a collaboration between colleagues Bart O’Callahan and … |
| 2022-11-01 | The Summit | The Summit is a physician-owned healthcare facility located in Hutchin… |
| 2022-11-01 | Urban Development Institute of Australia | Urban began as a collaboration between colleagues Bart O’Callahan and … |
| 2022-11-01 | PTSC | PTSC, a member of Vietnam Oil & Gas Group (PetroVietnam - PVN), was es… |
| 2022-11-01 | San Benito Consolidated Independent School District | San Benito Consolidated Independent School District provides elementar… |
| 2022-10-27 | ipb Baggenstos Montagen | ipb Baggenstos Montagen is a company that operates in Commercial & Res… |
| 2022-10-27 | Bergamo Metal | Bergamo metal operates in the production and use of gypsum board and p… |
| 2022-10-27 | Medilife Hastanesi | Medilife Hastanesi is a company that operates in the Restaurants indus… |
| 2022-10-27 | Qualified Staffing | Founded in 1988 and headquartered in Flint, Michigan, Qualified Staffi… |
CONFIRMED ATTACKS
Karakurt confirmed attacks: 30 verified incidents
Ransomnews has verified 30 Karakurt incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from December 2021 to August 2023. United States accounts for 25 of them (83%), with victims recorded in 5 countries in total. The most affected sector is healthcare, at 15 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 3; the outcome is unrecorded in the remaining 27. Where a figure was disclosed (22 cases), these incidents account for 1,896,252 exposed records.
30Verified incidents
5Countries
2021–2023Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Karakurt incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2023 | Yakima Valley Radiology | Healthcare | Washington, United States | 235,249 | Unknown | Source |
| August 2023 | Hospice of Huntington | Healthcare | West Virginia, United States | 9,013 | Unknown | Source |
| July 2023 | Valley Mountain Regional Center | Healthcare | California, United States | 126,679 | Unknown | Source |
| June 2023 | Regional Family Medicine | Healthcare | Arkansas, United States | 80,166 | Unknown | Source |
| June 2023 | El Centro Del Barrio d/b/a CentroMed | Healthcare | Texas, United States | 400,000 | Unknown | Source |
| May 2023 | Eastside Union School District | Education | California, United States | 3,592 | Unknown | Source |
| April 2023 | Reeds Spring R-IV School District | Education | Missouri, United States | — | Unknown | Source |
| April 2023 | McAlester Regional Health Center | Healthcare | Oklahoma, United States | 37,731 | Unknown | Source |
| April 2023 | Jefferson County Health Center | Healthcare | Iowa, United States | 53,827 | Unknown | Source |
| April 2023 | TransMedics, Inc. | Healthcare | Massachusetts, United States | 892 | Unknown | Source |
| April 2023 | Peachtree Orthopedic Clinic, P.A. | Healthcare | Georgia, United States | 34,691 | Unknown | Source |
| April 2023 | Medicalodges, Inc. | Healthcare | Kansas, United States | — | Unknown | Source |
| March 2023 | York County School of Technology | Education | Pennsylvania, United States | 30,914 | Unknown | Source |
| March 2023 | La Red Health Center | Healthcare | Delaware, United States | 39,759 | Unknown | Source |
| March 2023 | Pharm-Pacc Corporation | Healthcare | Florida, United States | 3,749 | Unknown | Source |
| March 2023 | Chattanooga Heart Institute | Healthcare | Tennessee, United States | 547,434 | Unknown | Source |
| March 2023 | Our Sunday Visitor, Inc. | Other | Indiana, United States | 2,743 | Unknown | Source |
| March 2023 | Petaluma Health Center | Healthcare | California, United States | 124,862 | Unknown | Source |
| March 2023 | OptionMetrics, Inc. | Finance | New York, United States | — | Unknown | Source |
| February 2023 | National Board of Osteopathic Medical Examiners | Education | Pennsylvania, United States | 4,310 | Unknown | Source |
| November 2022 | San Benito Consolidated Independent School District | Education | Texas, United States | 21,217 | Unknown | Source |
| October 2022 | Schrader-Pacific | Manufacturing | Virginia, United States | 1,719 | Unknown | Source |
| October 2022 | Municipalidad de Belén | Government | Belén, Costa Rica | — | Unknown | Source |
| September 2022 | Davenport Community Schools | Education | Iowa, United States | 7,473 | No | Source |
| August 2022 | International Centre for Migration Policy Development (ICMPD) | Other | Vienna, Austria | — | Unknown | Source |
| July 2022 | Methodist Health System (Methodist McKinney Hospital, Methodist Allen Surgical Center, and Methodist Craig Ranch Surgical Center) | Healthcare | Texas, United States | 125,401 | No | Source |
| June 2022 | l’Autorité de Régulation des Télécommunications et des Postes du Sénégal (ATRP) | Government | Dakar, Senegal | — | Unknown | Source |
| June 2022 | Gage Brothers Concrete Products, Inc. | Manufacturing | South Dakota, United States | 4,831 | Unknown | Source |
| January 2022 | Weldco-Beales Manufacturing | Manufacturing | Edmonton, Canada | — | No | Source |
| December 2021 | Tourisme Montréal (Visit Montreal) | Other | Montreal, Canada | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Karakurt's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.