Skira
Skira is a small ransomware group that emerged around late 2024, claiming responsibility for the breach of Carruth Compliance Consulting that exposed SSNs, W-2s, and financial records of employees across 36 US school districts, with five total claimed victims across the US, Turkey, and India.
Victims
8
First Discovered
2025-03-06
victim
Last Discovered
2025-11-18
victim
Inactive Since
260
days
Avg Delay
N/A
attack→claim
Infostealer
57.1%
victims with domain
Countries
4
hit
Attack Velocity — Last 12 months
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
SKIRA TEAM | No | 2026-04-28T07:21:45 |
mtgc3qvyedjnfu7cen2zsupdppi5ys5g2hm6xwujvoepw25p4dy6huid.onion
|
Target
Top 5 Activity Sectors
- Technology 3
- Financial Services 2
- Government & Defense 1
- Professional Services 1
- Manufacturing 1
Top 5 Countries
-
United States
4
-
India
2
-
Japan
1
-
Türkiye
1
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
session
1
| Type | IOC |
|---|---|
session
|
05172c3981b0053c3798a740aa875b9a4b41844e22b6124e92d6dbde387f454e41
|
Victims (8)
[AI generated] ITA (Independent Title Agency, LLC) is a US-based company specialized in providing co…
[AI generated] City Government Office in Van, Turkey, also known as van.bel.tr, is an administrative…
[AI generated] Carruth Compliance Consulting is a company dedicated to consulting on compliance chal…
[AI generated] CCL Products India is a leading manufacturer and exporter of instant coffee. It was e…
[AI generated] Krisala Developers is a renowned and well-established real estate company based in In…