Karkadann is an espionage-motivated threat actor that first emerged in October 2020, primarily targeting government bodies and news outlets in the Middle East. The group's operations are characterized by its use of tailor-made malicious documents and watering-hole attacks. Karkadann is notable for showing similarities to the Piwiks case, an earlier watering-hole attack campaign, and has been linked to the use of commercial spyware from companies like Candiru. Their primary motivation is information theft and espionage, distinguishing them through their focused targeting and specific initial access techniques rather than broad opportunistic attacks. Karkadann is also referred to by the alias Piwiks.