From dea8f8dd0b8e2b846f26151b7855c6870f1d75d3 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Fri, 15 Nov 2024 03:42:18 -0800 Subject: [PATCH] [threat-actors] Add Kairos --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 5ba3c61..6d423b6 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -17433,6 +17433,16 @@ }, "uuid": "c2f1f2e3-9573-49be-b01e-6ffff9a9571b", "value": "TA455" + }, + { + "description": "Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.", + "meta": { + "refs": [ + "https://www.cyjax.com/resources/blog/an-elephant-in-kairos-data-leak-site-emerges-for-new-extortion-group/" + ] + }, + "uuid": "4d3c9666-6e08-4186-854c-cc0f8c28f5b6", + "value": "Kairos" } ], "version": 320