KARAKURT

Overview 15 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 10 reports

Ranked by how many of this actor's indicators each report brought in.

• 7cisa.gov/uscert/ncas/alerts/aa22-152a
• 7virustotal.com/gui/ip-address/209.222.98.19/relations
• 7virustotal.com/gui/ip-address/78.31.67.191/relations
• 7otx.alienvault.com/pulse/62986c1750cc114c19b706ce
• 5twitter.com/CSICCybersecur1/status/1532431727292862…
• 5shodan.io/host/94.156.174.204
• 5virustotal.com/gui/ip-address/94.156.174.204/relations
• 1thedfirspot.com/general-8-1

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• 73
  1 report cite both

Timeline 15 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2024-11-16 1 domain2 yrs ago

   thedfirspot.com/general-8-1

   karaleaks.com

   copy batch

2. 2024-11-16 1 domain2 yrs ago

   gist.github.com/hrbrmstr/db75143d512faa983f7438b3f17e2f…

   3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion

   copy batch

3. 2022-06-29 1 ipv44 yrs ago

   twitter.com/S0ufi4n3/status/1542049327295696900

   178.255.220.111:3050

   copy batch

4. 2022-06-02 7 domain4 yrs ago

   cisa.gov/uscert/ncas/alerts/aa22-152a · virustotal.com/gui/ip-address/209.222.98.19/relations · virustotal.com/gui/ip-address/78.31.67.191/relations · otx.alienvault.com/pulse/62986c1750cc114c19b706ce

   blog.karakurt.tech

   internal.karakurt.tech

   karakurt.co

   karakurt.group

   karakurt.systems

   karakurt.tech

   omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion

   copy batch

5. 2022-06-02 2 domain, 3 ipv44 yrs ago

   twitter.com/CSICCybersecur1/status/1532431727292862… · shodan.io/host/94.156.174.204 · virustotal.com/gui/ip-address/94.156.174.204/relations

   domain	karachat.group
   domain	karachat.tech
   ipv4	94.156.174.204:3051
   ipv4	94.156.174.204:443
   ipv4	94.156.174.204:8443

   copy batch

Further reading 10

• gist.github.com/hrbrmstr/db75143d512faa983f7438b3f17e2f…
• thedfirspot.com/general-8-1
• twitter.com/CSICCybersecur1/status/1532431727292862…
• virustotal.com/gui/ip-address/209.222.98.19/relations
• twitter.com/S0ufi4n3/status/1542049327295696900
• cisa.gov/uscert/ncas/alerts/aa22-152a
• virustotal.com/gui/ip-address/78.31.67.191/relations
• virustotal.com/gui/ip-address/94.156.174.204/relations
• shodan.io/host/94.156.174.204
• otx.alienvault.com/pulse/62986c1750cc114c19b706ce