kairos Ransomware Group

Key insights

• •Kairos employs initial access brokers and exploits vulnerable remote services to gain access to victim networks.
• •The group exfiltrates sensitive data and threatens public disclosure to extract ransom payments from victims.
• •RClone, a legitimate file transfer utility, is a key tool utilized for data staging and exfiltration.
• •Kairos meticulously clears Windows Event Logs to evade detection during their operations.
• •They tailor ransom demands based on the financial capacity of the target and offer discounts for immediate payment.