DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 05:09:16ZSOURCES: 14CRITICAL: 39
⚠ ACTIVE ALERTS
@MsftSecIntel CRITICAL — Microsoft Defender Experts tracked increased ACR Stealer activity from late April through… /// @TalosSecurity CRITICAL — Qilin RaaS remains the most active ransomware operation globally in 2026 with 500+… /// @CrowdStrike CRITICAL — VECT ransomware + TeamPCP supply chain credential theft + BreachForums mass affiliate… /// @MandiantThreats CRITICAL — Tracking Qilin affiliate recruitment activity on Russian-language cybercrime forums… /// @FalconFeedsio CRITICAL — Dark web monitoring alert: FIFA World Cup 2026 credential ecosystem fully operational on…
39Critical Threats
18Active CVEs
8IOCs Tracked
11New Advisories
INTEL FEED/THREAT ACTORS/KAIROS
TLP:WHITETHREAT ACTOR DOSSIER // KAIROS-EXTORTIONFIRST SEEN: NOV 2024

KAIROS

ALSO KNOWN AS: None confirmed
FROM:DMZ INTELLIGENCE DESK
ORIGIN:Unknown (backend infrastructure geolocated to Ukraine; AS30860 Virtual Systems LLC; leak site seized by Ukrainian SBU)
ATTRIBUTION:ORGANIZED CRIME
STATUS:● ACTIVE
FIRST OBSERVED:NOV 2024
TECHNICALRESOURCESPERSISTENCESTEALTHIMPACT
TECHNICAL35/100
RESOURCES35/100
PERSISTENCE38/100
STEALTH30/100
IMPACT44/100

SUBJECT PROFILE

Kairos is a data-extortion actor first appearing in November 2024 that, per a Ransom-ISAC case study published July 4–5, 2026, extorted approximately $1 million from a U.S. government entity (likely Union County, Ohio) using only stolen-data exposure threats — no ransomware encryption was ever deployed. The group accessed the network via brute-force credential attack, exfiltrated 1.6 million files (2+ TB), and leveraged prosecutors' office records as maximum-pressure leverage. Kairos's leak site was seized by the Ukrainian Security Service (SBU); its last known victim was posted June 2026 and a linked wallet showed activity as recently as May 2026.

Financial — pure data-theft extortion (no encryption); targets under-resourced public sector entities holding sensitive citizen and law enforcement records

OPERATIONAL HISTORY

Brute-force credential access (T1110), data exfiltration (T1041), pure data-theft extortion (no encryptor), countdown timers and staged disclosure threats as negotiation pressure, temp.sh file-sharing for proof-of-theft delivery, Bitcoin ransom collection, rapid fund splitting to ByBit/OKX/BELQI for laundering

GOVERNMENT
PUBLIC SECTOR
LAW ENFORCEMENT
MUNICIPALITIES

KNOWN INFRASTRUCTURE

Tor onion leak site (seized by Ukrainian SBU); clear-net backend at 62.182.81.38 (Virtual Systems LLC, Ukraine, AS30860); Bitcoin payment wallets linked to ByBit, OKX, and BELQI (Russian exchange); email contact at KairosSupp@[redacted] mirroring LockBit branding convention

ATTRIBUTED CAMPAIGNS

FILE DATE: JUL 2026
Ransom-ISAC Public Disclosure — U.S. Gov $1M Payment
Researcher Rakesh Krishnan published a full case study on July 4–5, 2026 documenting Kairos's extortion of a U.S. government entity for ~$1M in Bitcoin via leaked negotiation chat and blockchain tracing, with clues pointing to Union County, Ohio.
FILE DATE: MAY 2025
Union County Ohio Intrusion
Kairos claimed brute-force access to a U.S. county government network, exfiltrating ████████████████████ prosecutors' office records, ultimately collecting ~9.44 BTC (~$1M) after month-long negotiations.
SHARE BRIEF:✕ Post on Xin Share on LinkedIn