Worked example · 2021-20

Karakurt encryption-free data-theft extortion operation — 2021–2025

Corrected 2026-10-11

Replaced the unsourced multi-vendor attribution list (Mandiant, Microsoft, CrowdStrike, SentinelOne, Recorded Future) with the sources actually found (CISA, Arctic Wolf/Chainalysis research, DOJ case coverage); initial-access description corrected to CISA's list; the Cl0p "prototype" and Conti-dissolution-survival claims are marked unverified.

Loss

Aggregate extortion-payment volume not publicly quantified at cluster level at v0.1. CISA reports demands from $25,000 to $13,000,000 in Bitcoin [cisakarakurt]; one victim paid more than $1.3M and another $250,000 [bleepkarakurt]. Karakurt (OAK-G18) is a Conti-side-channel data-extortion-only operation — the cluster steals data from victim organisations and threatens public disclosure, but does not deploy a ransomware encryptor. Karakurt used no encryption [cisakarakurt]; the claim that it was the "prototype" for the model OAK-G14 Cl0p later adopted at scale is OAK-internal framing and not established by the sources found. The cluster has been active since mid-2021 [bleepkarakurt] and was reported in April 2022 by Arctic Wolf (with Tetra Defense, Chainalysis and Northwave) to be a data-extortion arm of Conti [arcticwolfkarakurt]. Whether it survived the Conti wind-down as a standalone brand is unverified here: CISA notes the Karakurt leak-site domain and IP went offline in spring 2022 [cisakarakurt].

OAK Techniques observed

OAK-T5.008 (Ransomware Extortion Payment) — cryptocurrency-denominated extortion payments under threat of data disclosure. Karakurt demonstrates the "encryption-free" sub-pattern of T5.008: the extortion lever is exclusively the threatened disclosure of stolen data, not the denial-of-access-to-encrypted-data that characterises traditional ransomware. OAK-T15.001 (Social Engineering of Operator Personnel) — as classified in OAK; CISA lists initial access mainly via purchased stolen credentials, access brokers, unpatched VPN/firewall appliances, Log4Shell and some phishing [cisakarakurt], so this mapping is only partial. OAK-T8.001 (Cluster Reuse / Operator Fingerprinting) — Karakurt's Conti-side-channel lineage and encryption-free TTP fingerprint distinguish it from encryptor-deploying Conti-successor brands.

OAK-Gnn

OAK-G18 Karakurt.

Attribution

confirmed at the cluster-and-tooling level — CISA advisory AA22-152A [cisakarakurt], Arctic Wolf research with Chainalysis [arcticwolfkarakurt], and the US prosecution of alleged Karakurt negotiator Deniss Zolotarjovs (arrested in Georgia in December 2023; charged with money laundering, wire fraud and extortion) [bleepkarakurt]. The Conti link is inferred-strong: Arctic Wolf reported a Conti-left Cobalt Strike backdoor used in a Karakurt intrusion and shared wallets between Conti and Karakurt payment addresses [arcticwolfkarakurt]. The earlier statement that no one had been DOJ-indicted is superseded by the Zolotarjovs charges.

Key teaching point

Karakurt is an example of the "data-extortion-only" T5.008 sub-pattern: the threat actor's extortion lever is exclusively the threatened public disclosure of exfiltrated data — there is no ransomware encryptor deployed. This operational model eliminates the encryption-implementation risk (no decryptor-quality variance, no cryptographic flaws for defenders to exploit), reduces operational complexity (no encryptor development/maintenance overhead), and produces a structurally different victim-to-attacker negotiation surface. Cl0p's later data-theft campaigns (OAK-G14) used the same encryption-free approach; a causal "prototype" relationship is unverified.