Description Summary
Data-extortion (no encryption); ~50 victims under 'Kairos V2' by Aug 2025.
Threat Actor
Data extortion; selective exfil via RClone (targets PDFs/Office documents).
Technical Indicators
Encryption Extension
N/A — no encryption (exfiltration + extortion)
Encryption Algorithm
N/A
Ransom Note Name
N/A
Targeted Industries
Healthcare, Manufacturing, Business services
First Seen
13 November 2024
Last Seen
Active (Kairos V2 ~50 victims by Aug 2025)
Geographical Location
US (assessed Eastern-European/Russian origin)
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |