Skira is a small ransomware group emerging in late 2024, known for targeting the education sector to steal financial and personal data.
Skira is a small ransomware group that emerged in late 2024, targeting the education sector and stealing financial and personal identification data. They primarily target victims in the US, Turkey, and India, with a focus on employee records like SSNs and W-2s. Their TTPs likely involve data exfiltration ransomware and double extortion tactics. Defenders should prioritize protecting sensitive employee data in educational institutions and strengthen data leak monitoring.
Skira is a small ransomware group that emerged around late 2024, claiming responsibility for the breach of Carruth Compliance Consulting that exposed SSNs, W-2s, and financial records of employees across 36 US school districts, with five total claimed victims across the US, Turkey, and India.
Skira primarily targets the education sector.
Yes, their TTPs likely involve data exfiltration ransomware and double extortion tactics.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.