kraken
First seen February 9, 2025Active25 claimed victims
The claims below are reproduced as posted by kraken on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Kraken is a Russian-speaking ransomware group that emerged in February 2025, believed to have links to the HelloKitty operation, employing a RaaS model notable for a benchmarking step that measures victim machine speed to optimize encryption, and in September 2025 launched an underground criminal forum called "The Last Haven Board."
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.pointcag.com | November 13, 2025 | ransomware_live | — |
| www.ronvil.com | October 16, 2025 | ransomware_live | — |
| The Last Haven Board | September 2, 2025 | ransomware_live | — |
| www.mada.com.kw | July 25, 2025 | ransomware_live | — |
| www.optyma.co.uk | July 22, 2025 | ransomware_live | — |
| www.pomerandboccia.com | July 15, 2025 | ransomware_live | — |
| www.georgeallenconstruction.com | July 10, 2025 | ransomware_live | — |
| www.wheelsauto.com | July 10, 2025 | ransomware_live | — |
| www.ultrarapit.net | April 11, 2025 | ransomware_live | — |
| www.sanmarti.es | April 3, 2025 | ransomware_live | — |
| www.anubis-cosmetics.com | April 2, 2025 | ransomware_live | — |
| www.humac.dk | April 2, 2025 | ransomware_live | — |
| www.kvhealth.net | March 20, 2025 | ransomware_live | — |
| www.floralimited.com | February 28, 2025 | ransomware_live | — |
| www.circul-aire.com, www.dectron.com | February 25, 2025 | ransomware_live | — |
| www.skcounsel.com | February 18, 2025 | ransomware_live | — |
| www.prival.com | February 15, 2025 | ransomware_live | — |
| www.selt-sistemi.com | February 14, 2025 | ransomware_live | — |
| www.fudpucker.com | February 9, 2025 | ransomware_live | — |
| www.cdprojekt.com | February 9, 2025 | ransomware_live | — |
| Kitty cookies | February 9, 2025 | ransomware_live | — |
| ctntelco.com | January 9, 2025 | ransomware_live | — |
| www.mgl.law | November 28, 2024 | ransomware_live | — |
| www.cisco.com | April 24, 2024 | ransomware_live | — |
| www.continental.aero | February 12, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).