Cyber Threat Actor: Kerela Cyber Xtractors

Kerela Cyber Xtractors is a hacktivist group that operates under the alias Kerela Cyber Xtractors and is known to be based in India. The group presents itself as acting in response to perceived provocations against Indian interests, framing its activities as retaliatory measures. Their public actions have focused on disrupting online services belonging to governmental and diplomatic entities, particularly those associated with Pakistan. The stated strategic objective in their reported operations is to cause disruption by rendering target websites inaccessible, thereby hindering public access to information and services.

The group's observed tactics, techniques, and procedures are limited to distributed denial‑of‑service (DDoS) attacks aimed at overwhelming target networks with voluminous traffic. No specific malware families, initial access vectors, or bespoke tooling have been referenced in the available reporting, indicating that their operational style relies on readily available DDoS tools or services rather than custom-developed exploits. This focus on volumetric disruption aligns with their hacktivist motive of signaling dissent without pursuing financial gain or espionage.

A notable campaign occurred on May 18, 2023, when Kerela Cyber Xtractors launched a DDoS operation that paralyzed ten Pakistani embassy websites worldwide, including missions in France, Germany, Kazakhstan, and India itself. The attack was described as a direct retaliation for an earlier intrusion by the Pakistani group Team Insane PK against Indian State Police sites. By successfully disrupting these diplomatic portals, the group demonstrated its ability to affect international governmental infrastructure through coordinated, high‑volume traffic floods, underscoring its reliance on DDoS as a primary means of achieving its disruptive objectives.