Kairos Data Extortion: Stolen Data Without Encryption

Kairos appeared in late 2024 and has more than 100 claimed victims on ransomware.live. Unlike most groups on this blog, it usually does not encrypt systems at all. It copies data out and demands payment to keep it unpublished. A leaked negotiation analysed by Ransom-ISAC showed a US government body paying roughly $1 million in Bitcoin in June 2025, with no sign that any machine had been locked.

Kairos has been seen bidding for network access sold by initial access brokers, and incident responders describe intrusions using valid credentials rather than noisy exploits. Data is staged and moved out with Rclone. In at least one case, the group emailed the victim's staff from a compromised account to add pressure.

Because nothing may be encrypted, the main questions are what was taken, from which systems, and whether anything was deleted or changed on the way out. Logs from VPNs, firewalls, cloud storage and file servers answer that, and many of them are kept for only a few weeks, so export them early.

If files or databases were deleted or damaged during the intrusion, or if a ransomware group follows up with encryption, we recover them from the disks and backups. We have solved many cases like this. Contact us for a free assessment.