Stratus data allegedly leaked by Karakurt ransomware group

• Ransomware group: Karakurt
• Country: United States
• Announcement date: December 11, 2022

Karakurt claims to have stolen data from Stratus

The Karakurt ransomware group has published a claim on its leak site regarding a data breach involving the organization Stratus. According to the announcement made on December 11, 2022, the threat actors claim to have obtained a significant volume of corporate information belonging to the organization.

The group claims to have successfully exfiltrated a total of 774 GB of data from Stratus. While the total volume of the alleged theft is substantial, the announcement indicates that a specific portion of this dataset has been made available to the public. This released portion consists of 734,147 files, representing a significant amount of sensitive documentation.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms, a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems but also steal sensitive data, threatening to release it publicly if their demands are not met. This approach increases the pressure on the victim by threatening their reputation and legal standing.

Details of the alleged data leak

The data claimed to be stolen by the Karakurt group includes a variety of sensitive corporate and personal information. Based on the information provided by the threat actor, the leaked content encompasses several critical categories of documentation that could impact both the organization and its personnel.

The specific types of data identified in the claim include:

• Employee HR data
• Salary information
• Performance evaluations
• Email correspondence

In addition to these categories, the leak is said to include employee hiring documents, wage adjustment forms, and various other corporate documents. The exposure of such a diverse range of files suggests a deep intrusion into the organization's internal communications and human resources systems.

Impact and potential risks

The exposure of this information presents several significant risks to the organization and its employees. Because the leaked data contains personal information belonging to the organization's staff, there is a heightened risk of identity theft and the execution of targeted phishing attacks against the individuals involved. Attackers can use specific details from performance evaluations or email correspondence to craft highly convincing social engineering campaigns.

Furthermore, the breach may have negative consequences for the organization's operational processes. The scale of the breach could potentially compromise the security of data that the organization shares with third parties, leading to a ripple effect of security concerns across its supply chain. The loss of sensitive information regarding corporate processes also poses a threat to the organization's commercial reputation.

Given that the organization operates in the United States, this incident may trigger specific legal obligations. The exposure of personal data may necessitate data breach notifications under various state laws and federal regulations. Organizations facing similar threats often focus on strengthening their defensive posture through multi-factor authentication, regular security awareness training, and robust data encryption to mitigate the impact of such leaks.

Limited information on the threat actor

At this time, information regarding the Karakurt group remains limited. While the group has demonstrated the ability to exfiltrate large volumes of data, further technical details regarding their specific methods or infrastructure are not currently available.