Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Inactive · #242 by victimsRansomware group

Karma

As of Oct 19, 2026, Karma has listed 7 confirmed victims on its leak site since Jul 11, 2025, 0.0% of all victims tracked by Brandefense.

Karma is a ransomware group first observed in mid-2021, part of a lineage tracing back through Nefilim and FiveHands, operating double-extortion attacks against enterprises in healthcare, manufacturing, and technology; the group was managed by threat actor "farnetwork" who ran multiple RaaS programs across related strains.

Also known asKarma Ransomware
Is My Company Listed?Follow KarmaRequest IOC Feed

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
7
Rank By Victims
#242
Last Leak-Site Post
Jul 11, 2025
Top Country
Unknown
Top Sector
Unknown

Victims Posted Per Month.

Karma confirmed victims per month
MonthConfirmed victims
July 20257
August 20250
September 20250
October 20250
November 20250
December 20250
January 20260
February 20260
March 20260
April 20260
May 20260
June 20260
July 20260
August 20260
September 20260
October 2026 (month in progress)0
Updated continuously · figures as of Oct 19, 2026

Latest Karma Victims.

Search all 7 →
Latest confirmed leak-site victims claimed by Karma
VictimCountryIndustryData claimedPosted
Our first postUnknownUnknownNot stated
Saurer. Part 1.UnknownUnknownNot stated
Align Technology. Part 1.UnknownUnknownNot stated
The next leak will be of a multi billion dollar cosmetics and fragrance company.UnknownUnknownNot stated
Align Technology. Part 2.UnknownUnknownNot stated
SI Group. Part 1.UnknownUnknownNot stated

MITRE ATT&CK.

63 techniques across 14 tactics
Reconnaissance6
  • T1071.001
    Application Layer Protocol: Web Protocols
  • T1082
    System Information Discovery
  • T1583.001
    Acquire Infrastructure: Domains
  • T1585.002
    Establish Accounts: Email Accounts
  • T1589
    Gather Victim Identity Information
  • T1595.002
    Active Scanning: Vulnerability Scanning
Resource Development9
Initial Access10
  • T1021.001
    Remote Services: Remote Desktop Protocol
  • T1078
    Valid Accounts
  • T1078.002
    Valid Accounts: Domain Accounts
  • T1078.004
    Valid Accounts: Cloud Accounts
  • T1133
    External Remote Services
  • T1190
    Exploit Public-Facing Application
  • T1204.002
    User Execution: Malicious File
  • T1560.001
    Archive Collected Data: Archive via Utility
  • T1566
    Phishing
  • T1651
    Cloud Administration Command
Execution8
  • T1047
    Windows Management Instrumentation
  • T1059.001
    Command and Scripting Interpreter: PowerShell
  • T1059.006
    Command and Scripting Interpreter: Python
  • T1072
    Software Deployment Tools
  • T1105
    Ingress Tool Transfer
  • T1119
    Automated Collection
  • T1213.002
    Data from Information Repositories: Sharepoint
  • T1485
    Data Destruction
Persistence4
  • T1098
    Account Manipulation
  • T1219.002
    Remote Access Tools: Remote Desktop Software
  • T1484.001
    Domain or Tenant Policy Modification: Group Policy Modification
  • T1547.001
    Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Defense Evasion7
  • T1027.015
    Obfuscated Files or Information: Compression
  • T1036.004
    Masquerading: Masquerade Task or Service
  • T1036.005
    Masquerading: Match Legitimate Resource Name or Location
  • T1074
    Data Staged
  • T1102
    Web Service
  • T1490
    Inhibit System Recovery
  • T1564.003
    Hide Artifacts: Hidden Window
Credential Access5
Discovery1
Collection5
Command and Control1
Exfiltration1
  • T1041
    Exfiltration Over C2 Channel
Impact3
Defense Impairment1
  • T1686.003
    Disable or Modify System Firewall: Windows Host Firewall
Stealth2
MITRE ATT&CK® technique names © The MITRE Corporation, reproduced with permission.

Arsenal.

  • BiBiMalware
  • BiBi-LinuxMalware
Threat intelligence updated Oct 19, 2026.

History.


  1. First seen in Brandefense data

  2. Busiest month on record: 7 confirmed victims

  3. First confirmed victim listed on its leak site

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.