107 victims listed on the Kairos leak site across 16 countries.
Most recent disclosure .
Victims
107
0.4% of all tracked
Countries
16
Most: United States
Sectors
16
Most: Business Services
First seen
Nov 2024
In this database
ThreatAI analysis
Compiled from the ransomware.live profile for Kairos and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Kairos is a data extortion threat actor targeting small-to-mid-sized organizations in healthcare, manufacturing, and business services primarily in the US, recorded 107 victims across 16 countries.
Who Kairos is
Kairos is a data extortion group active since late 2024 that focuses solely on data theft with no encryption, primarily targeting small-to-mid-sized organizations in healthcare, manufacturing, and business services in the US, purchasing initial access from brokers and demanding Bitcoin payments.
Recorded activity
Disclosures attributed to Kairos in this database run from November 2024 to October 2026, totalling 107 victims — 0.4% of everything tracked here. Kairos has listed victims in 16 countries in this database, most often United States, followed by Australia and United Kingdom. The sectors appearing most in its listings are Business Services, Education, Healthcare.
YARA detection rules
kairos.yar
/*
Kairos ransomware
*/
rule Kairos_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.kairos"
description = "Detects Kairos ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "Kairos" ascii nocase
$s2 = "KAIROS" ascii
$s3 = "kairos.onion" ascii nocase
condition:
any of them
}
Community-contributed rules for Kairos, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
Threat actor analysis
Kairos has disclosed 107 victims
on its leak site, 0.4% of all ransomware listings tracked in this database.
Its earliest disclosure here dates to November 2024.
The group has listed organisations in 16 countries,
most often in United States
(59 victims),
followed by Australia, United Kingdom, France.
By industry, its listings concentrate in Business Services, Education, Healthcare —
sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.
Like most current ransomware operations, Kairos is likely to use double extortion:
data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site
with the stolen data as leverage.
Kairos is a ransomware threat group that has claimed 107 victims since its first known activity in November 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has Kairos attacked?
Kairos has claimed 107 victims in our database, representing 0.4% of all tracked ransomware attacks. The most targeted countries are United States, Australia, United Kingdom, France.
Which countries does Kairos target?
Kairos has attacked organizations in 16 countries. The top targeted countries are: United States, Australia, United Kingdom, France.
Which industries does Kairos target?
Kairos most frequently targets the Business Services, Education, Healthcare sectors based on victim disclosures in our database.
Is Kairos still active?
Kairos's most recent victim disclosure in our database was on October 14, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.
This site uses cookies for analytics and advertising.
Cookie policy
CTI Digest
Every Monday, the 5 threats SOC teams can't afford to miss — with analyst commentary.
