THREAT ACTOR
KRAKEN_
DormantKRAKEN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KRAKEN, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 1
- 2025 27
Leak site mirrors
19 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
krakenccj3wr23452a4ibkbkuph4d6soyx2xgjoogtuamc3m7u7wemad.onionKraken leak blog snapshot · 2026-08-13 06:13 -
zq3k4odlfpbzc5y4sxqgolivelxepceaakru3xqo4ll2czmvvtek2ryd.onionIndex of / snapshot · 2026-01-21 08:03 -
t3uouzfvsaqurb2rzoe2mkpetp54d7lgtl45ply34v5lugsnzysmkhid.onionIndex of / snapshot · 2026-01-21 08:08 -
xbupelqsy7lubogl6kdtdqguxoleehbxnuuqm2dos6bbmdwablpqckad.onionsnapshot · 2025-07-11 18:06 -
mvr2bidstp52pkaybzccjueux4hqbkukuqiss6vhn72qwqruzc7awsid.onionIndex of / snapshot · 2026-01-21 08:30 -
vmnnrqf3gs3kl2kfnxatughwmnlyq6qxzyx24ylyh2w36vw3gqwqjpqd.onionIndex of / snapshot · 2026-01-21 08:13 -
ko3lwb6glib74kmol5ov5cphabwqmifb5lnjw4bvj75jpfigrfbn7gid.onionIndex of / snapshot · 2026-01-21 08:05 -
wkqvktnmr2slazl76opbkdli4ia6gznhxln2z5wny54hf4kzjwgqvxyd.onionIndex of / snapshot · 2026-01-21 08:20 -
cjhuttkivmtrf6itrmyoqnxw55isy3dh6u5ifc3fnhajp7lwn5deflid.onionIndex of / snapshot · 2026-01-21 08:21 -
3cxvgnwvbzzfm2abzxidi76uib53vsjudsavgzm4viaj26drkcdl6wad.onionIndex of / snapshot · 2026-01-21 08:02 -
ab2v4xzffr24pdmswqzrbg45pwsget4h7eyd4swxewuqbxmlwcju7lad.onion/Index of / snapshot · 2026-01-21 08:21 -
fk5c3gxraixjl3p7zacchn4jvew35vxo5xpedqf2qtlynsheqymampid.onion/Index of / snapshot · 2026-01-21 08:09 -
yjsknaecbmhvrsagrcwqelpojnbcllt6v27vxebxhnotd3wu67onc5qd.onionIndex of / snapshot · 2026-01-20 21:12 -
kxntyq6yyfomjoqqya6px7pgc6mbfcbaejryxhiwpntcnlr7hopqj3yd.onionIndex of / snapshot · 2026-01-21 08:23 -
2puszzzqvfv2eco7idbt2fznn2iwlsw27ns5xq3ad257mui2keakacqd.onionsnapshot · 2025-08-11 12:15 -
ebcbyeua65jtsnbsqsjahurkfj6yndhcwnnfxvwwg4yegb5h7fxjc5ad.onionIndex of / snapshot · 2026-01-21 08:32 -
2lqlecl4q4hkrb3rl5p27b4hptnz7lqaaux5uca3g6pylpqlhqyafvad.onionIndex of / snapshot · 2026-01-21 08:34 -
74fwiwaeqvtuf6uddankq5pzq637zpput3qxzq36fcxkhltq5plcxdqd.onionIndex of / snapshot · 2026-01-21 08:13 -
2teh35rkn63fvigugpqroctxol2yfn745k57jmk23d42fwuujpfpnpid.onionIndex of / snapshot · 2026-01-21 08:23
Recent victims
The 50 most recent victims claimed by KRAKEN. Total in the index: 28.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-11 | - | GINGER CONSULTING Coming soon...... |
| 2025-11-13 | www.pointcag.com | POINT provides expert Construction Management Consulting and Litigatio… |
| 2025-10-16 | www.ronvil.com | Ronemus & Vilensky LLP is a New York-based law firm specializing in pe… |
| 2025-09-03 | The Last Haven Board | In an era where digital communication is both ubiquitous and increasin… |
| 2025-07-25 | www.mada.com.kw | Mada Communications formerly known as ARAB TELECOMMUNICATIONS (ArabTel… |
| 2025-07-22 | www.optyma.co.uk | Established in 1987, Optyma is a principle provider of integrated secu… |
| 2025-07-15 | www.pomerandboccia.com | Pomer & Boccia has been in business since 1989 and operates a debt rec… |
| 2025-07-10 | www.wheelsauto.com | "For over 35 years Wheels Automotive Dealer Supplies has been Canada’s… |
| 2025-07-10 | www.georgeallenconstruction.com | George Allen Construction specializes in providing innovative solution… |
| 2025-07-06 | www.selt-sistemi.com | The first part of leak http://t3uouzfvsaqurb2rzoe2mkpetp54d7lgtl45ply… |
| 2025-07-06 | www.ctntelco.com | Cyber security, cloud services? Hah... ok Pwned http://zq3k4odlfpbz… |
| 2025-07-06 | www.sanmarti.es | Transportes Sanmarti SA http://3cxvgnwvbzzfm2abzxidi76uib53vsjudsavgz… |
| 2025-07-04 | www.humac.dk | Humac was established in 1989 and has sold and serviced Apple products… |
| 2025-07-04 | www.prival.com | Banking · Panama http://yjsknaecbmhvrsagrcwqelpojnbcllt6v27vxebxhno… |
| 2025-07-04 | www.skcounsel.com | Scott & Kraus, LLC is a boutique law firm located in Chicago specializ… |
| 2025-07-04 | www.continental.aero | www.continental.aero Continental Aerospace Technologies is a global l… |
| 2025-07-04 | www.sanmarti.es | www.sanmarti.es Transportes Sanmarti SA http://3cxvgnwvbzzfm2abzxi… |
| 2025-07-04 | www.anubis-cosmetics.com | www.anubis-cosmetics.com ANUBIS COSMETICS, S.L. http://cjhuttkivmt… |
| 2025-07-04 | www.floralimited.com | www.floralimited.com Flora Limited http://wkqvktnmr2slazl76opbkdli… |
| 2025-07-04 | www.ultrarapit.net | www.ultrarapit.net ULTRA RAPIT, S.L. http://ko3lwb6glib74kmol5ov5c… |
| 2025-05-12 | www.kvhealth.net | |
| 2025-05-12 | www.circul-aire.com, www.dectron.com | |
| 2025-02-09 | ctntelco.com | |
| 2025-02-09 | www.fudpucker.com | |
| 2025-02-09 | www.mgl.law | |
| 2025-02-09 | www.cdprojekt.com | |
| 2025-02-09 | www.cisco.com | |
| 2025-02-09 | Kitty cookies |
CONFIRMED ATTACKS
Kraken confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Kraken incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2025 to June 2025. United States accounts for 2 of them (67%), with victims recorded in 2 countries in total. The most affected sector is legal, at 1 confirmed victim. Where a figure was disclosed (2 cases), these incidents account for 1,580 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Kraken incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2025 | Humac by C&C | Retail | Copenhagen, Denmark | — | Unknown | Source |
| February 2025 | Scott & Kraus, LLC | Legal | Illinois, United States | 1,049 | Unknown | Source |
| February 2025 | Klickitat Valley Health | Healthcare | Washington, United States | 531 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Kraken's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.