Kazu is a financially motivated ransomware group that emerged in early to mid-2025, operating a double extortion model by exfiltrating sensitive data prior to encrypting files and demanding payment. The group primarily targets government agencies, public-sector institutions, healthcare providers, and financial services organizations globally, with a notable focus on Latin America, Southeast Asia, and the Middle East. Kazu distinguishes itself by consistently leveraging dark web leak sites and social media channels to announce victims and pressure them into paying ransoms, frequently posting proof of stolen data from compromised entities.

Aliases del actor

APT HIGAISAapolloshadowatg26blue pythonkazuarkyptonsnakestorm-0156uroburosvenomous bearwainscotwaterbug

Actores similares

apt-blueprintactor · 1apt-higaisaactor · 1apt-noisybearactor · 1APT29 (Cozy Bear)actor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0apt-c-01actor · 2apt-c-27actor · 2

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker