A cybercrime threat group that has been working in the dark since June 2021 has just been exposed by security researchers. The group, tracked as Karakurt, are financially motivated threat actors who have been increasing their cyber activity throughout the third quarter of this year. Currently, Karakurt has two registered domains, social media accounts, and several blog sites, all of which are variations of the Karakurt group name. These threat actors are focused solely on data exfiltration and extortion without demanding ransomware payments from their victims. Over forty (40) entities have been compromised from the group, with thirty-eight (38) of their victims originating in the North American region. Furthermore, these victims are involved in various industries including technology, professional services, hospitality, health services, retail, energy, industrial, media & entertainment, and manufacturing. Tactics of the threat group involve first breaching victim networks with exposed VPN credentials, either by purchasing exposed datasets on the deep/dark web or unleashing phishing campaigns to gather the intelligence themselves. Following, threat actors will commonly deploy the Cobalt Strike RAT, however recently the group has pivoted to an AnyDesk malicious payload. Once compromised, Karakurt actors will harvest credentials of administrators for privilege escalation, then exfiltrate data from the network(s) and leak the data on their website. CTAPT is continuing to track the movements of this threat group and will provide additional updates as needed.