Watch Floor
Ransomware

Kairos

4mentions, 7 days
4mentions, 30 days
1victims posted, 30 days
Nov 4, 2026last mentioned

Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

  • Oceania Digital Communications
    Oct 14, 2026

A leak-site post is the group's claim, not confirmed by the victim.

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.