Kraken is a Russian-speaking RaaS ransomware group known for benchmarking victim machines to optimize encryption.
Kraken is a Russian-speaking ransomware group that emerged in February 2025, likely linked to the HelloKitty operation. Operating under a RaaS model, the group primarily targets corporate networks. Key TTPs include a unique benchmarking step that measures victim machine speed to optimize encryption, and the launch of an underground criminal forum called 'The Last Haven Board' in September 2025. Defenders should monitor for anomalous system profiling activity prior to encryption and strengthen controls against initial access vectors associated with this group.
Kraken is a Russian-speaking ransomware group that emerged in February 2025, believed to have links to the HelloKitty operation, employing a RaaS model notable for a benchmarking step that measures victim machine speed to optimize encryption, and in September 2025 launched an underground criminal forum called "The Last Haven Board."
Kraken uses a unique benchmarking step that measures victim machine speed to optimize encryption.
The Kraken group launched an underground criminal forum called 'The Last Haven Board' in September 2025.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.