{
  "aliases": [
    "Karakurt Lair",
    "Karakurt Team"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 11,
    "ipv4": 4
  },
  "first_seen": {
    "domain": {
      "3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion": "2024-11-16",
      "blog.karakurt.tech": "2022-06-02",
      "internal.karakurt.tech": "2022-06-02",
      "karachat.group": "2022-06-02",
      "karachat.tech": "2022-06-02",
      "karakurt.co": "2022-06-02",
      "karakurt.group": "2022-06-02",
      "karakurt.systems": "2022-06-02",
      "karakurt.tech": "2022-06-02",
      "karaleaks.com": "2024-11-16",
      "omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion": "2022-06-02"
    },
    "ipv4": {
      "178.255.220.111:3050": "2022-06-29",
      "94.156.174.204:3051": "2022-06-02",
      "94.156.174.204:443": "2022-06-02",
      "94.156.174.204:8443": "2022-06-02"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {}
  },
  "first_seen_range": {
    "earliest": "2022-06-02",
    "latest": "2024-11-16"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion",
      "blog.karakurt.tech",
      "internal.karakurt.tech",
      "karachat.group",
      "karachat.tech",
      "karakurt.co",
      "karakurt.group",
      "karakurt.systems",
      "karakurt.tech",
      "karaleaks.com",
      "omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion"
    ],
    "ipv4": [
      "178.255.220.111:3050",
      "94.156.174.204:3051",
      "94.156.174.204:443",
      "94.156.174.204:8443"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "KARAKURT"
  ],
  "references": [
    "https://gist.github.com/hrbrmstr/db75143d512faa983f7438b3f17e2f5a",
    "https://otx.alienvault.com/pulse/62986c1750cc114c19b706ce",
    "https://twitter.com/CSICCybersecur1/status/1532431727292862464",
    "https://twitter.com/S0ufi4n3/status/1542049327295696900",
    "https://www.cisa.gov/uscert/ncas/alerts/aa22-152a",
    "https://www.shodan.io/host/94.156.174.204",
    "https://www.thedfirspot.com/general-8-1",
    "https://www.virustotal.com/gui/ip-address/209.222.98.19/relations",
    "https://www.virustotal.com/gui/ip-address/78.31.67.191/relations",
    "https://www.virustotal.com/gui/ip-address/94.156.174.204/relations"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "73"
    }
  ],
  "slug": "KARAKURT",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-16",
      "indicators": {
        "domain": [
          "karaleaks.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.thedfirspot.com/general-8-1"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-16",
      "indicators": {
        "domain": [
          "3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://gist.github.com/hrbrmstr/db75143d512faa983f7438b3f17e2f5a"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-06-29",
      "indicators": {
        "ipv4": [
          "178.255.220.111:3050"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/S0ufi4n3/status/1542049327295696900"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "blog.karakurt.tech",
          "internal.karakurt.tech",
          "karakurt.co",
          "karakurt.group",
          "karakurt.systems",
          "karakurt.tech",
          "omx5iqrdbsoitf3q4xexrqw5r5tfw7vp3vl3li3lfo7saabxazshnead.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cisa.gov/uscert/ncas/alerts/aa22-152a",
        "https://www.virustotal.com/gui/ip-address/209.222.98.19/relations",
        "https://www.virustotal.com/gui/ip-address/78.31.67.191/relations",
        "https://otx.alienvault.com/pulse/62986c1750cc114c19b706ce"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 3
      },
      "first_seen": "2022-06-02",
      "indicators": {
        "domain": [
          "karachat.group",
          "karachat.tech"
        ],
        "ipv4": [
          "94.156.174.204:3051",
          "94.156.174.204:443",
          "94.156.174.204:8443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/CSICCybersecur1/status/1532431727292862464",
        "https://www.shodan.io/host/94.156.174.204",
        "https://www.virustotal.com/gui/ip-address/94.156.174.204/relations"
      ],
      "total": 5
    }
  ]
}