Search threats, CVEs… ⌘K
← Back to all threat actors

kazu

Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.

How we source and review actor profiles
Motivation
ransomware
Last seen
2026-09-07
Sectors
healthcare, professional-services, government-defense, other, technology, education, financial-services
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimMSM Unify: Global Education Platform - CA listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimStatistics South Africa – Official National Data and Insights Portal listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGauteng City Region Academy (GCRA) listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHealthDaq listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHealth Time listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNatclar (S.G. Natclar S.A.C.) listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGauteng Provincial Government listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimConsultorioMovil: Telemedicine and Healthcare System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMeducar: Telemedicine and Patient Management System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCentro Médico Especializado OSI: Healthcare Solutions listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDr Akbar Niazi Teaching Hospital listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPawlyClinic: Digital Veterinary Care Platform listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCanada Yocale: Appointment Management System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBrazil Mobilemed: Cloud PACS Platform listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimInstituto Ferrero de Neurología y Sueño listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPappyJoe: Healthcare Management System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator5 indicators cataloged

Types: onion.

First listed
Victim claimSpirit Cultural Exchange - US listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPappyJoe: Healthcare Management System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimInstituto Ferrero de Neurología y Sueño listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBrazil Mobilemed: Cloud PACS Platform listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCanada Yocale: Appointment Management System listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPawlyClinic: Digital Veterinary Care Platform listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDr Akbar Niazi Teaching Hospital listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCentro Médico Especializado OSI: Healthcare Solutions listed by kazu

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 36 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

kazuCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...