Kairos
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
5 observed public claim posts in the collection window 2025-11-21 through 2026-10-25. Accumulated bounded samples: newest 1,000 records from each of the current and previous source years, refreshed every six hours. Historical gaps are not filled. These are not confirmed attacks or unique victims. Dates are provider record dates; countries are provider classifications; unknown is retained. Source: Ransomfeed — Dario Fadda · CC BY 4.0. Adapted into anonymous counts by Kinwilder; no endorsement implied.
United States of America: 2 posts
India: 1 posts
Vanuatu: 1 posts
France: 1 posts
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.