Ransomware Group

Kazu

Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.

Known victims20

Threat level

LOW

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Indicators of Compromise (IOCs)

IP addresses

23.137.255.139

Get the complete IOC feed

The full IOC database by API, ready for your SIEM or SOAR.

Create free account

No credit card required · Free API key

Known infrastructure

The following Tor hidden services have been associated with this group:

kazu7japbm72xaxqnjhajlvkuo4czf2q5ye7ucc4fmyjpgunc6ggezyd.onion
kazuuyscnd6emsrzkpelzxgxvro2wgrngku4g7btuunsandnjv5f52ad.onion
kazusemtykpxnnosg3gp56spcdkg7tro6ozei7ikamdgnwpwpbwagbyd.onion
kazu2x7vux5gmbrrqnbujbpe5njyqua5ulixubfcf64qae7qbvce4gqd.onion
Ransom - KAZU

These sites are malicious. Open them only from an isolated environment.

Check if you’re affected

Look up your domain to see whether it appears on Kazu’s victim list.

Try it nowFree⌘K

Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBit ALPHV Blackcat CL0P Play BianLian Akira Medusa Rhysida