Joint Federal Advisory on Karakurt Data Extortion Group Technical Details

Context

On June 1, 2022, the United States Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigations (FBI), the Treasury Department, and the Financial Crimes Enforcement Network released a joint advisory with technical details and indicators of compromise for the Karakurt data extortion group.

Karakurt is an advanced persistent threat (APT) group focused on stealing data and demanding ransom from targets in exchange for not leaking the data. The group is known as particularly aggressive when soliciting ransom, frequently harassing employees, clients, and business partners to pressure the target to cooperate. The group’s website went offline at the beginning of 2022 and the group moved their data leak announcements to deep web forums. Karakurt is also known to exaggerate the extent and severity of their compromises to encourage targets to pay.

Technical Details

Karakurt’s known tactics, techniques, and procedures (TTPs) include:

• Purchasing stolen credentials
• Buying access to targets through intrusion brokers
• Working with other cybercriminal group

Intrusion vectors commonly used by the group include:

• Various SonicWall SSL VPN appliance CVEs
• Log4j
• Phishing and spearphishing
• Malicious macros in email attachments
• Stolen credentials, especially VPN and remote desktop protocol (RDP) credentials
• Various Fortinet Fortigate SSL VPN appliance CVEs
• Outdated Windows server instances

Karakurt is known to deploy Cobalt Strike to enumerate networks and install Mimikatz to steal plain text credentials. Once access to a target system is achieved, Karakurt uses unspecified tools to exfiltrate large amounts of data and in some cases, entire share drives.

IOCs

The joint advisory included the following IOCs: