Home Threat actors Kairos Incidents attributed to:
Kairos Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector.
Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.
References
Actor metadata imported from Malpedia (Fraunhofer FKIE).
Related incidents
Jericho Fire Department was named on the Kairos ransomware data-leak (extortion) site on 2025-06-03.
Victim Jericho Fire Department
Neighborhood Development Services was named on the Kairos ransomware data-leak (extortion) site on 2025-05-21.
Victim Neighborhood Development Services
Durham Arts Council was named on the Kairos ransomware data-leak (extortion) site on 2025-05-20.
Victim Durham Arts Council
Looper Goodwine was named on the Kairos ransomware data-leak (extortion) site on 2025-05-13.
Victim Looper Goodwine
Colorado Pulmonary Intensivists was named on the Kairos ransomware data-leak (extortion) site on 2025-04-24.
Victim Colorado Pulmonary Intensivists
The Derby High School was named on the Kairos ransomware data-leak (extortion) site on 2025-04-23.
Victim The Derby High School
d-line was named on the Kairos ransomware data-leak (extortion) site on 2025-04-17.
Victim d-line
RFMS, Inc. was named on the Kairos ransomware data-leak (extortion) site on 2025-04-08.
Victim RFMS, Inc.
Galesburg Area Chamber of Commerce was named on the Kairos ransomware data-leak (extortion) site on 2025-04-07.
Victim Galesburg Area Chamber of Commerce
State's Attorney Office was named on the Kairos ransomware data-leak (extortion) site on 2025-04-01.
Victim State's Attorney Office
Fred Salvucci was named on the Kairos ransomware data-leak (extortion) site on 2025-03-10.
Victim Fred Salvucci
USA Rice<br /> was named on the Kairos ransomware data-leak (extortion) site on 2025-03-05.
Victim USA Rice<br />
Vitenas Cosmetic Surgery was named on the Kairos ransomware data-leak (extortion) site on 2025-03-03.
Victim Vitenas Cosmetic Surgery
Fireplace Warehouse was named on the Kairos ransomware data-leak (extortion) site on 2025-02-24.
Victim Fireplace Warehouse
Dane Court Grammar School was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Victim Dane Court Grammar School
Toi Toi USA was named on the Kairos ransomware data-leak (extortion) site on 2025-02-17.
Victim Toi Toi USA
Casper's Truck Equipment was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
Victim Casper's Truck Equipment
Medical Reports was named on the Kairos ransomware data-leak (extortion) site on 2025-02-04.
Victim Medical Reports
DEL Packaging was named on the Kairos ransomware data-leak (extortion) site on 2025-01-29.
Victim DEL Packaging
The Urswick School was named on the Kairos ransomware data-leak (extortion) site on 2025-01-20.
Victim The Urswick School
Nightingale Hammerson was named on the Kairos ransomware data-leak (extortion) site on 2025-01-17.
Victim Nightingale Hammerson
Real Tax was named on the Kairos ransomware data-leak (extortion) site on 2025-01-16.
Victim Real Tax
Combined Pool and Spa was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
Victim Combined Pool and Spa
J.G. Electrical Installations was named on the Kairos ransomware data-leak (extortion) site on 2025-01-15.
Victim J.G. Electrical Installations