Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
kazu Ransomware Group
Ransomware group profile
Description
kazu is a financially motivated ransomware and data extortion group that emerged around mid-2025, notably targeting government agencies and healthcare providers. They utilize sophisticated tactics for initial access and data exfiltration, employing a double-extortion model to coerce victims into paying ransoms.
Key insights
- •Targets include government agencies, public-sector institutions, and healthcare providers.
- •Initial access is typically gained through exploiting RDP services and unpatched web applications.
- •The group uses SmokeLoader as the initial loader to deliver ransomware payloads.
- •Employs a double-extortion tactic, exfiltrating data before encrypting files.
- •Ransom demands range from $60,000 to $500,000, with threats to publish stolen data.
Threat Level & Status Breakdown
For kazu · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for kazu in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for kazu
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1566.001
T1566.001
T1133
T1133
T1190
T1190
T1021
T1021
T1562
T1562
T1046
T1046
Victims(78)
Page 1 of 4
Affected countries(38)
Countries where this group has been reported to target or leak victims.