Unleashing the Kraken ransomware group
Summary: The Kraken ransomware group emerged in February 2025, runs a double extortion operation with a data leak site, and has hit victims across the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait without concentrating on any single vertical. Cisco Talos observed one intrusion in which the actor gained initial access through an SMB vulnerability on an internet-exposed server, stole privileged credentials, returned over Remote Desktop, installed Cloudflared for a reverse tunnel and SSHFS to exfiltrate data, then deployed the encryptor across systems via RDP, with a ransom demand of about 1 million USD in Bitcoin.
What you should know: Kraken is suspected to have risen from the HelloKitty cartel, and in September 2025 it announced an underground forum, The Last Haven Board, with announced support from the HelloKitty team and exploit buyer WeaCorp - a supply line for access and exploits that outlasts any single ransomware crew.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·