kairos
Known ransomware group Dormant / low-volume
Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and business services in the US, purchasing initial access from brokers and demanding Bitcoin payments.
2
Total Claims
1
Critical
—
Records Claimed
2
Industries Hit
Active span: May 29, 2026 – Sep 30, 2026 · 2 organizations targeted
Dormant / low-volume
Actor Threat Profile
Activity Timeline
Peak: May 2026 (1)May 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Healthcare 1
Public Sector 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
3
Known leak sites