kazu

Executive Summary

Kazu is an emerging ransomware group employing double extortion tactics. Targeting primarily government, healthcare, and financial organizations in Southeast Asia, the Middle East, and Latin America, Kazu has achieved notable breaches, including Dubai's Ports, Customs, and Free Zone Corporation.

Goals & Targeting

Kazu targets sectors like government, healthcare, and finance due to their high data value and ability to disrupt operations, making them ideal for double extortion. Their focus on Southeast Asia, Middle East, and Latin America may reflect lower cybersecurity maturity or active criminal infrastructure in these regions.

Kazu emerged in September 2025 as a ransomware group with a focus on double extortion tactics. Their operations have primarily targeted sectors with high data value and potential for financial gain, such as government, healthcare, and financial institutions. Notable victims include Dubai's Ports, Customs, and Free Zone Corporation, where over 1.94 TB of data was exfiltrated. Kazu's geographic focus suggests targeting regions with potentially lower cybersecurity defenses or active criminal networks. The group's motivation is financial gain through ransoms and extortion, leveraging the critical nature of their victims' services to pressure payouts.

Key Capabilities

• Double extortion tactics
• Data exfiltration
• Ransomware deployment

MITRE ATT&CK Tactics

ATT&CK Techniques

Campaigns & Victims

Kazu's campaigns have targeted critical infrastructure, leveraging the high stakes of their victims to demand ransoms. Their operational timeline from September 2025 to January 2026 suggests a focused and evolving threat, with notable success in breaches affecting significant economic hubs.

IOC Patterns

• Spear-phishing emails with malicious attachments
• C2 communication via domain generation algorithms (DGA)
• Lateral movement across networks using legitimate protocols

Recommended Actions

• Implement regular backups and test restoration processes
• Educate users on phishing and suspicious emails
• Segment critical systems to limit lateral movement
• Monitor for异常网络活动, especially encrypted traffic
• Encrypt sensitive data at rest

Suggested Tags