Kairos

The threat actor gains initial access to victim networks by exploiting externally exposed Remote Desktop Gateway services, frequently leveraging weak or default credentials susceptible to password spraying attacks in environments lacking multi-factor authentication.

Following infiltration, the actor performs internal environment exploration and harvests credentials. Tools are deployed to facilitate privilege escalation and internal reconnaissance, with observed attempts to utilize PowerShell, SMB, and Remote Desktop for lateral movement.

Kairos operates primarily as a data-extortion group that prioritizes exfiltration over file-encryption. The actor threatens public exposure of sensitive data on a dedicated leak site to coerce payment. Reported incidents often involve the theft of large volumes of data (e.g., 2 TB) without confirmed deployment of encryption lockers.

The group utilizes psychological manipulation, including time-bound escalation, fixed negotiation windows, and threats to increase disclosure scope if victims contact law enforcement or incident response firms. Negotiations often involve multi-million dollar demands that may be settled for lower amounts.