Threat taxonomy
critical activityRansomwareFirst seen 2024
Kesari Locker
Aliases: KSR · Kesari RaaS
A RaaS operation whose affiliates favour virtualised environments, encrypting hypervisor datastores after staging exfiltration through cloud storage providers.
Attribution
Ransomware-as-a-service with regional affiliates
Primary targets
- — Microfinance
- — Insurance
- — Mid-tier banks
- — Managed service providers
Observed tactics
- Initial access via stolen VPN credentials
- Hypervisor management plane compromise
- Exfiltration to commodity cloud storage
- Leak site publication within 14 days
Regional relevance
Institutions with consolidated virtualisation and limited offline backups face full-service outage risk rather than partial disruption.
Detection guidance
- Alert on hypervisor SSH enablement
- Monitor for mass snapshot deletion
- Detect large egress to consumer cloud storage domains
Related feed reporting
- high11 Sept 2026
Ransomware affiliate leaks data claimed from a regional microfinance group
- medium24 Aug 2026
Ransomware crew adds double-extortion pressure via regulator notification threats