Talos Details Kraken Ransomware’s Attack Chain and Cross-Platform Encryption
Summary
Cisco Talos analyzes Kraken, a ransomware group linked possibly to HelloKitty, describing its SMB-based access, credential theft, Cloudflared persistence, data exfiltration, and Windows, Linux, and ESXi encryptors.
Key points
- Talos observed Kraken conducting double-extortion attacks in August 2025; the opportunistic group targets organizations across multiple sectors and regions.
- In one intrusion, Kraken exploited an internet-exposed SMB service, stole privileged credentials, and used RDP to regain access and move laterally.
- The attackers installed Cloudflared for a persistent reverse tunnel and used SSHFS to navigate the environment and exfiltrate data before encryption.
- Kraken has distinct Windows, Linux, and ESXi encryptors. It can encrypt local drives, network shares, SQL databases, and virtual-machine files, appending the .zpsc extension.
- The ransomware benchmarks encryption speed to choose full or partial encryption, and uses techniques including obfuscation, backup and recovery disruption, and cleanup of execution traces.
- Talos describes possible links to HelloKitty, including a shared ransom-note filename and an announcement of support for Kraken’s underground forum.
- Talos lists Snort SIDs 65480 and 65479 and ClamAV detections for Kraken; it also points to additional IOCs in its GitHub repository.
Article Details
- Attack Vectors
- Kraken gained initial access in one observed intrusion by exploiting an unspecified vulnerability in an internet-exposed SMB service.
- After extracting privileged-account credentials, the attacker re-entered the victim environment over Remote Desktop and used RDP connections for lateral movement and ransomware deployment.
- The attacker installed Cloudflared and configured a reverse tunnel for persistent access, then used SSHFS to navigate the victim environment and exfiltrate data.
- Kraken ransomware encrypted files on Windows, Linux, and ESXi systems, including local drives, network shares, SQL databases, and virtual-machine files.
- On Windows, the ransomware stopped backup services and removed restore points; the Linux/ESXi variant also deleted logs, shell history, and its own files after encryption. It used control-flow obfuscation and sleep-based delays to hinder analysis.
- Defensive Notes
- The article recommends keeping Cisco Talos detections and protections current, including Cisco Secure Endpoint, Secure Firewall, Secure Network/Cloud Analytics, and Cisco Secure Malware Analytics.
- Cisco Duo is recommended for multi-factor authentication to restrict unauthorized network access.
- The article lists Snort SIDs 65480 and 65479 and ClamAV detections Win.Ransomware.Kraken-10056931-0 and Unix.Ransomware.Kraken-10057031-0.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe attacker used Remote Desktop connections for re-entry and lateral movement, including to deploy ransomware.T1027 · Obfuscated Files or InformationThe article reports control-flow obfuscation in the Windows and Linux/ESXi encryptors.T1048.002 · Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolThe attacker used SSHFS to exfiltrate sensitive data from the victim environment.T1059.001 · PowerShellThe Windows encryptor ran embedded PowerShell commands to change execution policy, enumerate Hyper-V files, and stop virtual machines.T1070.003 · Clear Command HistoryThe Linux/ESXi cleanup script deleted shell history.T1070.004 · File DeletionThe Linux/ESXi variant used a cleanup script to delete logs and the ransomware binary after encryption.T1078 · Valid AccountsThe attacker used extracted privileged-account credentials to re-enter the victim environment.T1190 · Exploit Public-Facing ApplicationKraken exploited an unspecified vulnerability in an internet-exposed SMB service for initial access.T1486 · Data Encrypted for ImpactKraken encrypted victim files, appending the .zpsc extension.T1490 · Inhibit System RecoveryKraken stopped backup services and removed restore points on Windows systems.T1497.003 · Time Based ChecksThe ransomware used a sleep-based execution delay to evade sandbox analysis.T1572 · Protocol TunnelingThe attacker installed Cloudflared and configured a reverse tunnel for persistent access.
People
Threat Actors
Malware
Products
ESXiKraken is a cross-platform ransomware with distinct encryptors for Windows, Linux, and VMware ESXi, targeting a wide range of enterprise environments. LinuxKraken is a cross-platform ransomware with distinct encryptors for Windows, Linux, and VMware ESXi, targeting a wide range of enterprise environments. Microsoft WindowsKraken is a cross-platform ransomware with distinct encryptors for Windows, Linux, and VMware ESXi, targeting a wide range of enterprise environments. NutanixNutanix Synology NASSynology NAS devices
Tools
Cloudflaredactor exploited Server Message Block (SMB) vulnerabilities for initial access, then used tools like Cloudflared for persistence and SSH Filesystem (SSHFS) for data exfiltration before encryption. SSHFSvulnerabilities for initial access, then used tools like Cloudflared for persistence and SSH Filesystem (SSHFS) for data exfiltration before encryption.
Countries
Canadato Kraken’s leak site, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait. Denmarkleak site, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait. Kuwaitspan various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait. Panamasite, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait. United KingdomAccording to Kraken’s leak site, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait. United Statesbusiness verticals. According to Kraken’s leak site, victims span various geographies, including the United States, the United Kingdom, Canada, Denmark, Panama, and Kuwait.