Rakhni ransomware affected file
File type: Ransomware encrypted file
A .kraken file is a file encrypted and renamed by the Rakhni ransomware family.
The .kraken suffix indicates that the file's original contents are inaccessible until the encryption is successfully removed.
File type category:
Ransomware encrypted file
Date updated: October 12, 2026
The .kraken file extension is used for files encrypted and renamed by Rakhni ransomware. The file contains the encrypted contents of an original user file, rather than data in a separate document format.
Rakhni-related ransomware has been distributed under Trojan detections including the following:
A different ransomware that uses the .kraken suffix appeared in December 2016. It is known as Kraken Ransomware and appears to be unrelated to the original Rakhni ransomware.
The suffix is an indicator of a ransomware-affected file, not a documented format intended for normal applications. RakhniDecryptor is a Microsoft Windows utility from Kaspersky that may decrypt files from supported Rakhni variants.
A .kraken file cannot normally be opened in its original application while it remains encrypted. Use RakhniDecryptor on Microsoft Windows to attempt decryption.
The decryptor may not support every Rakhni variant, so successful recovery is not guaranteed.
A .kraken file cannot be meaningfully converted while it is encrypted. Decrypt it first with RakhniDecryptor; after recovery, the resulting file can be opened or converted according to its original format.
Software apps that recover kraken files:
Microsoft Windows
Language
