Karkoff

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.karkoff

Threat Analysis

Karkoff is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html

→https://blog.telsy.com/apt34-aka-oilrig-attacks-lebanon-government-entities-with-maildropper-implant/

→https://blog.yoroi.company/research/karkoff-2020-a-new-apt34-espionage-operation-involves-lebanon-government/

→https://cyware.com/blog/apt34-the-helix-kitten-cybercriminal-group-loves-to-meow-middle-eastern-and-international-organizations-48ae

→https://mp.weixin.qq.com/s/o_EVjBVN2sQ1q7cl4rUXoQ

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

KarkoffMailDropperOILYFACECACTUSPIPEwin.karkoff

External Intelligence

Malpedia: win.karkoff

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Karkoff