Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Kazu
As of Oct 19, 2026, Kazu has listed 26 confirmed victims on its leak site since Nov 6, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is Argentina (15.4% of its victims) and its most targeted sector is Healthcare.
Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 26
- Rank By Victims
- #151
- Last Leak-Site Post
- Sep 7, 2026
- Top Country
- Argentina
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 9 |
| September 2026 | 8 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 3 |
| December 2025 | 4 |
| January 2026 | 2 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 9 |
| September 2026 | 8 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 3 |
| December 2025 | 4 |
| January 2026 | 2 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 9 |
| September 2026 | 8 |
| October 2026 (month in progress) | 0 |
Latest Kazu Victims.
Search all 26 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Statistics South Africa - Official National Data and Insights Portal statssa.gov.za | ZASouth Africa | Government and Public Sector | Not stated | |
| Gauteng City Region Academy (GCRA) gcra.gauteng.gov.za | ZASouth Africa | Education and Research | Not stated | |
| HealthDaq healthdaq.com | IEIreland | Consulting | Not stated | |
| Health Time htmedica.com | ESSpain | Healthcare | Not stated | |
| Natclar (S.G. Natclar S.A.C.) natclar.com.pe | PEPeru | Healthcare | Not stated | |
| Gauteng Provincial Government gauteng.gov.za | ZASouth Africa | Government and Public Sector | Not stated |
How They Operate.
Kazu's threat actor profile lists 1 ATT&CK techniques, 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Kazu Targets.
Sectors
History.
First confirmed victim listed on its leak site
First seen in Brandefense data
Busiest month on record: 9 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.