CISA Alert AA22-152A Karakurt data extortion group. [CISA Cybersecurity Alerts]

Published: June 1, 2022, 9:15 p.m.

b"The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury (Treasury), and the Financial Crimes Enforcement Network (FinCEN) are releasing this joint Cybersecurity Advisory to provide information about the Karakurt data extortion group, also known as the Karakurt Team and Karakurt Lair. Karakurt actors have employed a variety of TTPs, creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors claim to steal data and threaten to auction it or release it to the public unless they receive payment.\\nAA22-152A Alert, Technical Details, and Mitigations\\nCISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide\\nData Integrity: Detecting and Responding to Ransomware and Other Destructive Events. Stopransomware.gov\\xa0\\nCISA's Ransomware Readiness Assessment\\nCISA's cyber hygiene services\\nFinCEN Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime\\nFinCEN Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments\\nAll organizations should report incidents and anomalous activity to CISA\\u2019s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI\\u2019s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov."