Threat Actor Unknown origin

Kairos

IoCs CSV 1 detection rule

Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.

Indicators of Compromise 1

Domain temp.sh

MITRE ATT&CK TTPs 4

Detection Rules

Kairos_SIGMA_Detection

sigma ai_generated

title: Kairos Threat Actor Data Exfiltration Activity
id: 3a1b8a6c-4d2f-4a0e-9f1e-5b7c8d9e7f3a
status: experimental
logsource:
  category: network_connection
  product: firewall
detection:
  outbound_connection:
    DestinationIP: '*'
    DestinationPort: '80' or '443'
    Protocol: 'TCP'
  user_agent_tempsh:
    UserAgent|contains: 'temp.sh'
  ttp_t1071001:
    Description: 'Use of web protocols for command and control or data exfiltration'
  ttp_t1059001:
    CommandExec: '*curl*temp.sh*'
    CommandLine|contains:
      - 'curl'
      - 'wget'
    CommandLine|contains|all:
      - 'temp.sh'
      - '-F'
  ttp_t1021:
    Description: 'Remote services used for lateral movement - possible precursor to exfiltration'
  ttp_t1566:
    Description: 'Phishing enabled initial access - may lead to data theft'
  filter_known_benign:
    DestinationDomain|endswith: 'temp.sh'
condition: >
  (outbound_connection and (user_agent_tempsh or ttp_t1059001)) or
  (ttp_t1071001 and filter_known_benign)
falsepositives:
  - Legitimate use of file upload services like temp.sh for non-malicious purposes
level: critical

⚠ Rules are AI-generated and unvalidated. Test in a safe environment before production use.

Source Articles

U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case

A U.S. government entity, likely Union County, Ohio, paid approximately $1 million to a threat actor named Kairos following a data theft extortion incident. Unlike traditional ransomware attacks, Kairos did not encrypt systems but instead exfiltrated sensitive data—including files from the prosecutor's office—and threatened to leak it unless paid. The attack highlights a growing trend of pure data-theft extortion, where the leverage is the threat of public data disclosure rather than encryption. The payment of 9.44 BTC was traced through blockchain to exchanges including Bybit, OKX, and the Russian service BELQI, but no confirmation of data deletion was verifiable.

hacker-news ·1d ago