Infinitum IT analysts have assessed a strong link between the ransomware-driven Conti threat organization and the Karakurt Hacking Team. The Conti ransomware organization is a group of threat actors that perceives themselves as the prime ransomware-as-a-service group, creating malicious scripts, dropping ransomware on compromised systems, and launching extensive ransom/phishing campaigns. Alternatively, Karakurt, first observed in the wild in 2021 is primarily known for extorting stolen sensitive information from their targets and leaking the data on their website. The connection linking these threat organizations comes from remote data storage endpoints utilized by Conti ransomware, where the DNS records revealed a hosting connection to 209[.]222[.]98[.]19. This IP address is also the hosting address for Karakurt’s public facing blog page utilized for leaking data from their victims. Additional connections between both groups come from gathered SSH credentials and SSH private keys to Karakurt’s blog page. It is assessed that when a Conti ransomware attack occurs on a target and the attack does not complete the encryption stage, the gathered data would be extorted by Karakurt on their blog page. CTIX analysts will continue to monitor these threat organizations for any fallout around this new information and provide additional insight accordingly.