Karakurt__2022__AA22-152A_Karakurt_Data_Extortion_Group.pdf

This joint FBI/CISA/Treasury/FinCEN advisory details the Karakurt data extortion group’s activities: how they gain initial access (stolen credentials, vulnerable VPN/firewall appliances, Log4Shell, phishing), the tools they use (Cobalt Strike, Mimikatz, rclone, AnyDesk), large-scale data exfiltration and public extortion/auctioning of stolen data, example indicators of compromise (email addresses, hashes, bitcoin wallets, TOR leak site), and recommended mitigations including MFA, patching, backups, and detection guidance.