Kraken

Kraken is an overloaded malware name that has referred to multiple distinct threats. The best-supported modern usage is a Golang-based Windows botnet first observed in 2021. That botnet spread via SmokeLoader, established persistence, evaded Microsoft Defender by adding exclusions, hid its executable, and supported downloading and executing secondary payloads, running shell commands, taking screenshots, and stealing cryptocurrency wallet data. Operators were observed primarily using it to deploy information stealers such as RedLine Stealer, and later also other stealers and cryptocurrency miners. Some builds briefly included SSH brute-force functionality, though reporting indicated it was quickly removed and not observed in operational use. Historically, Kraken has also referred to the older Bobax/Oderoor spam botnet, known for large-scale spam operations and use of a domain generation algorithm. Separately, in 2025, Kraken was used as the name of a ransomware operation linked to remnants of the HelloKitty ecosystem, conducting double-extortion and targeting Windows, Linux, and VMware ESXi with platform-specific encryptors. Because these are distinct malware lineages sharing the same name, attribution and classification should be handled carefully to avoid conflating the 2021 Windows botnet with the historical spam botnet or the later ransomware operation.