Kazu is an emerging ransomware group responsible for hitting 22 victims across twelve countries this year, targeting mainly healthcare, education, and public sector organizations in Southeast Asia, the Middle East, and Latin America.
Who Kazu is
Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.
Recorded activity
Disclosures attributed to Kazu in this database run from November 2025 to September 2026, totalling 22 victims — 0.1% of everything tracked here. Kazu has listed victims in 12 countries in this database, most often United States, followed by Canada and Mexico. The sectors appearing most in its listings are Healthcare, Education, Public Sector.
Indicators of compromise
Showing a sample of 1 IP, 2 EMAIL on file. Hashes and network indicators published for Kazu. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.
YARA detection rules
kazu.yar
/*
kazu ransomware
*/
rule kazu_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.kazu"
description = "Detects kazu ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "kazu" ascii nocase
$name2 = "KAZU" ascii
$onion = "kazu.onion" ascii nocase
condition:
any of them
}
Community-contributed rules for Kazu, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
