Kazu
| Active
Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.
Victims
20
First Victim
2025-11-06
(est. attack date)
Discovery Date
2025-11-11
Last Seen
2026-09-07
Inactive Since
19
days
Avg Delay
2.5
days
Infostealer
100.0%
victims with domain
Countries
12
hit
Uptime
40.6% avg (30d)
Data Exfiltrated
28.1 TB
reported across 8/20 victims
Attack Velocity — Last 12 months (based on attack estimated date if available)
-78% vs last month
Known Locations (5)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Ransom - KAZU | Yes | 2026-09-26T18:14:01 | Apache 2.4.65 (Debian) |
6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion
|
|||
|
No | 2026-09-26T18:12:51 |
kazusemtykpxnnosg3gp56spcdkg7tro6ozei7ikamdgnwpwpbwagbyd.onion
|
|||||
|
No | 2026-09-26T18:13:02 |
kazu2x7vux5gmbrrqnbujbpe5njyqua5ulixubfcf64qae7qbvce4gqd.onion
|
|||||
|
No | 2026-09-26T18:11:19 |
kazuuyscnd6emsrzkpelzxgxvro2wgrngku4g7btuunsandnjv5f52ad.onion
|
|||||
|
No | 2026-09-26T18:10:10 |
kazu7japbm72xaxqnjhajlvkuo4czf2q5ye7ucc4fmyjpgunc6ggezyd.onion
|
Target
Top 5 Activity Sectors
- Healthcare 11
- Education 2
- Professional Services 2
- Government & Defense 2
- Technology 1
Top 5 Countries
-
United States
5
-
Canada
2
-
Brazil
2
-
Mexico
2
-
Colombia
2
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (6)
Email
2
IP Address
1
PGP
1
Session
2
Victims (20)
MSM Unify is a global education technology platform that helps students find and apply to internatio…
Spirit Cultural Exchange is a U.S.-based organization that provides international cultural exchange …
PappyJoe is an India-based healthcare technology company that provides a cloud-based practice manage…
Instituto Ferrero de Neurología y Sueño (IFN) is a specialized medical center in Argentina that focu…
Mobilemed is a Brazil-based health technology company that provides a cloud-based PACS (Picture Arch…
Yocale is a cloud-based business management platform that helps appointment-based businesses streaml…
PawlyClinic is a digital veterinary care platform that connects pet owners with licensed veterinaria…
Dr. Akbar Niazi Teaching Hospital (ANTH) is a 500-bed tertiary care teaching hospital located in Isl…
Centro Médico Especializado OSI is a healthcare provider based in Peru that specializes in physical …
Meducar is a Latin American healthtech platform that provides software for doctors and clinics to ma…
digital healthcare platform designed to help doctors, clinics, and medical professionals manage thei…
zHealthEHR is a cloud-based electronic health record (EHR) and practice management platform built pr…
ManageMyHealth is a New Zealand-based online platform that enables individuals to conveniently manag…
Saudi Icon specializes in design and build solutions, offering a holistic approach to construction a…
Leadway Assurance Company Limited is the leading insurance provider in Nigeria, offering a comprehen…
CT Dent Ltd is an independent CBCT imaging centre based in London, UK, specializing in dental CT sca…
The official portal of the Comisión Nacional del Servicio Civil (CNSC), Colombia’s National Civil Se…
The official online portal of the Defensoría del Pueblo de Colombia, a constitutional and autonomous…
Doctor Alliance (doctoralliance.com) is a U.S.-based healthcare technology platform that helps physi…