Kairos

Kairos is a financially motivated data-theft extortion operation tracked since late 2024. Researchers often include it in ransomware datasets, but a Ransom-ISAC case study found no encryptor or locker confidently linked to the group. Its demonstrated leverage is the threatened publication of purportedly stolen data. “Kairos V2” is a name TRM Labs associates with the operation; public evidence does not establish whether it denotes a formal rebrand or a distinct team.

Activity and targeting

FTI Cybersecurity described Kairos as emerging in late 2024 and making claims chiefly against U.S. organizations. TRM’s October 2025 research identified healthcare, manufacturing and business services among its reported targets. A 2026 Ransom-ISAC study reconstructed a data-extortion negotiation with a U.S. government body. These examples describe observed and claimed activity, not a limit on whom the operation may target. A Kairos monitoring page showed continued victim postings on Oct. 1, 2026.

Methods and operational characteristics

TRM reported that Kairos purchases access from initial access brokers and pressures victims with threats to publish files. In one Kairos-linked intrusion investigated by Triskele Labs, an attacker used valid credentials through an exposed Remote Desktop Gateway, attempted credential access and lateral movement, cleared Windows event logs, and transferred selected documents with Rclone over SFTP. Triskele observed no encryption in that case and documented email and telephone pressure against the victim. Ransom-ISAC’s separate negotiation study documented file-list sharing, publication deadlines and a payment, while treating the group’s access and deletion assertions as unverified.

What type of group is it?

Kairos’s observed demands and payment activity support a financially motivated cyberextortion assessment. Its payment flows analyzed by TRM overlap with cash-out infrastructure used by other groups, which may indicate shared affiliates or services; they do not establish that those groups have the same operators. Public research has not established a state sponsor or a Kairos encryptor. Individual victim listings, including the Oct. 1 Slate Valley claim, remain allegations until independently corroborated.