New ‘Karakurt’ cybercrime gang focuses on data theft and extortion | Cybersecurity News

According to Accenture’s security specialists, Karakurt is an intelligent and financially driven threat actor. The group’s operations were exposed in June 2021 and increased rapidly in Q3 2021.
Without using ransomware, the group is primarily concerned with data theft and extortion. In the period between September and November of 2021, a total of 40 individuals were affected by this group. Data exfiltration and extortion are the primary goals of the criminals, who do not use ransomware to encrypt their victims’ files. The vast majority of known victims (95%) live in North America, with the remaining 5% in Europe.
Initially, the group used Cobalt Strike, a common post-exploitation tool. Using a VPN IP pool or AnyDesk software to prevent detection has become a recent assault strategy for them.
After hacking a specific network, the Karakurt cybercrime gang utilizes numerous things for escalating privileges. They use PowerShell or Mimikatz to get ntds.dit that has important Active Directory data. In addition, for data exfiltration, the gang uses WinZip and 7zip for compression and FileZilla or Rclone to upload information to Mega.io cloud storage.
#Cybersecurity # News #cybercrime #datatheft