// THREAT ACTOR
KAIROS_
ActiveKAIROS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KAIROS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
130
Victims tracked
1 / 12
Active mirrors
2024-11-13
First listing
2026-08-20
Most recent
Victims by year
- 2026 28
- 2025 88
- 2024 14
Leak site mirrors
12 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onionSBU snapshot · 2026-04-24 08:43 -
dwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onion403 Forbidden snapshot · 2025-02-06 07:14 -
dngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onion404 Not Found snapshot · 2025-05-27 19:15 -
usqa5b33yyc2u6kqf5au64cgj64acl2umtll76qutlmu7fckw6kh6wqd.onion403 Forbidden snapshot · 2026-05-04 09:21 -
esmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onionFiles snapshot · 2026-06-02 10:12 -
2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onionFiles snapshot · 2025-07-25 05:05 -
pj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onionsnapshot · 2025-08-01 15:15 -
vpj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.oniontitle – Just another WordPress site snapshot · 2026-06-20 10:06 -
whodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onionFiles snapshot · 2026-05-13 10:19 -
khom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onionIndex snapshot · 2026-05-26 09:03 -
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onionSBU snapshot · 2026-04-24 08:12 -
cvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onionKairos snapshot · 2026-08-25 16:23
Recent victims
The 50 most recent victims claimed by KAIROS. Total in the index: 130.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-20 | Ayuntamiento de Velilla de San Antonio | El Ayuntamiento de Velilla de San Antonio es el organismo oficial de g… |
| 2026-08-12 | Hightech Signs | Hightech Signs, Inc. is a full-service sign shop located in Charlottes… |
| 2026-07-30 | Warwick Fabrics | As one of the world’s leading textile and soft furnishing wholesalers,… |
| 2026-07-25 | Thermalex Inc | Thermalex specializes in aluminum extrusion solutions, offering high-e… |
| 2026-07-22 | LR Reed | LR Reed is a family-owned business with over 30 years of experience, s… |
| 2026-07-20 | College O'Sullivan de Québec | Collège O'Sullivan de Québec offers a variety of training programs bot… |
| 2026-06-14 | Commune De Camiers | Commune De Camiers is a company that operates in the Government indust… |
| 2026-05-15 | McCarthy Inc | McCarthy, Inc., based in Savannah, Georgia, has been providing quality… |
| 2026-05-12 | McParlane & Associates | cParlane & Associates, Inc. is headquartered in San Diego, CA and dire… |
| 2026-05-12 | ARWINI | Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARW… |
| 2026-05-12 | Ayuntamiento de Valdemoro | Ayuntamiento de Valdemoro is the municipal government of Valdemoro, a … |
| 2026-05-07 | Houk Air Conditioning | Houk AC is a leading HVAC repair and installation service based in Tex… |
| 2026-04-22 | Gregory Jewellers | Gregory Jewellers Pty Ltd is an Australian-owned, family-operated fine… |
| 2026-04-20 | Nordenta (a daughter company of LIFCO) | Nordenta og al dente nyhedsbrev Tilbud, produktnyheder og inspiration … |
| 2026-04-18 | Hazel Mercantile | Hazel Mercantile Limited (HML) is a multi-faceted organization with di… |
| 2026-04-18 | South Florida Injury Centers | South Florida Injury Centers was founded in 2000 by Dr. Brian Wilner, … |
| 2026-04-18 | Colonial Presbyterian Church | We are a community of believers who seek to be the Light of Christ in … |
| 2026-04-18 | Pullen Moving | Pullen Moving Company owns and operates two warehouses for storing hou… |
| 2026-04-18 | FriendlyCare Pharmacy | FriendlyCare Pharmacy offers a wide range of health and beauty product… |
| 2026-04-18 | Strata Republic | Strata Republic is a strata management company based in Sydney and Byr… |
| 2026-03-21 | Resch Maschinenbau | Wir setzen in unserer Position als Fertigungsspezialist neben einer qu… |
| 2026-03-16 | Folet & Rivoire | Notre équipe d'avocats expérimentés, est à même de répondre à la plupa… |
| 2026-03-10 | Institute of Social Security - Paraguay | The Instituto de Previsión Social or IPS is the institution responsibl… |
| 2026-03-03 | Katz Kantor Stonestreet & Buckner | Katz, Kantor, Stonestreet & Buckner serves all of West Virginia with c… |
| 2026-02-27 | Rockwood Retirement Communities | With more than 65 years of mission-driven nonprofit service and two th… |
| 2026-02-14 | Robbins Parking Service Ltd | Robbins got its start back in 1958 when Jack Robbins, an entrepreneur … |
| 2026-02-13 | The Marena Group | Contains a set of SQL databases For the past 30 years, Marena has bee… |
| 2026-02-12 | Seagrass Boutique Hospitality Group | Full Service Restaurants, Brand Development & Operating Specialists |
| 2025-12-19 | Aneticaid | Innovative Medical Technology Practically Applied Anetic Aid is a UK w… |
| 2025-12-19 | Archlou | We are the Catholic Church in Central Kentucky, disciples of Jesus Chr… |
| 2025-12-19 | Askyouraccountant | Accounting & Advisory Services provide strategic guidance beyond bookk… |
| 2025-12-19 | Austinsfs.com | Our team of integrated Accountants and Financial Planners strive to pr… |
| 2025-12-19 | Brownpacking | Brown Packing Co., Inc. is a beef packing company located in Gaffney, … |
| 2025-12-19 | Business.galesburg | Looking for a community that can cater to your needs while keeping you… |
| 2025-12-19 | Casperstruck | Caspers Truck Equipment is a leading distributor specializing in equip… |
| 2025-12-19 | Clayplattefamily | We are Clay Platte Family Medicine Clinic, PC. and we are the largest … |
| 2025-12-19 | Combinedpoolandspa | Combined Pool and Spa, in the city of Sioux Falls, SD, offers an incre… |
| 2025-12-19 | D-Line | D-Line is a UK company, based in Newcastle upon Tyne, with a global re… |
| 2025-12-19 | Dane Court | Dane Court is one of only a handful of schools in the UK to offer both… |
| 2025-12-19 | Delpackaging | At DEL Packaging, we take great pride in our work. Our incredible team… |
| 2025-12-19 | Dr Vitenas | Our Houston plastic surgery practice is dedicated to offering an excep… |
| 2025-12-19 | Durhamarts | Durham Arts Council, Inc. is a catalyst in the cultural development of… |
| 2025-12-19 | Eisenhowerlaw | Eisenhower Carlson PLLC is a full-service law firm based in Tacoma, Wa… |
| 2025-12-19 | Ekonomipoolen | Ekonomipoolen i Mark AB offers a range of financial services including… |
| 2025-12-19 | Evanspharmacy | Evans Pharmacy (Daleacre Healthcare Ltd) is a small, family owned busi… |
| 2025-12-19 | Fred Salvucci | Fred Salvucci Corporation is a mason subcontractor specializing in com… |
| 2025-12-19 | Heidelberggc | At Heidelberg Golf Club. We offer not only a beautiful 18 hole golf co… |
| 2025-12-19 | Jerichofd | In 1933, a group of dedicated men recognized the need to protect our c… |
| 2025-12-19 | Kansasrmc | Kansas Regenerative Medicine specializes in regenerative therapies, ut… |
| 2025-12-19 | Medical Reports | Medical Reports is a trading style of Genesis Group Solutions Ltd esta… |
// CONFIRMED ATTACKS
Kairos confirmed attacks: 20 verified incidents
Ransomnews has verified 20 Kairos incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2024 to July 2026. United States accounts for 8 of them (40%), with victims recorded in 8 countries in total. The most affected sector is healthcare, at 6 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 3; the outcome is unrecorded in the remaining 16. Where a figure was disclosed (5 cases), these incidents account for 80,276 exposed records.
20Verified incidents
8Countries
2024–2026Active range
25%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Kairos incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | LR Reed | Retail | Melbourne, Australia | — | Unknown | Source |
| May 2026 | Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARWINI) | Healthcare | Hannover, Germany | — | No | Source |
| May 2026 | Ayuntamiento de Valdemoro | Government | Valdemoro, Spain | — | No | Source |
| April 2026 | Friendly Care Management Pty Ltd (FriendlyCare Pharmacy) | Healthcare | Booval, Australia | — | Unknown | Source |
| April 2026 | Gregory Jewellers | Retail | Sydney, Australia | — | Unknown | Source |
| April 2026 | Nordenta A/S | Healthcare | Hørning, Denmark | — | Unknown | Source |
| March 2026 | Instituto de Previsión Social (IPS) | Government | Ascunción, Paraguay | — | Unknown | Source |
| February 2026 | South Florida Injury Centers, Inc. | Healthcare | Florida, United States | 1,525 | Unknown | Source |
| February 2026 | Katz, Kantor, Stonestreet & Buckner, PLLC | Legal | West Virginia, United States | — | Unknown | Source |
| February 2026 | Seagrass Boutique Hospitality Group | Food and Beverage | Rhodes, Australia | — | Unknown | Source |
| September 2025 | Ekonomipoolen i Mark AB | Finance | Stockholm, Sweden | — | Unknown | Source |
| August 2025 | Melland High School | Education | Manchester, United Kingdom | — | Unknown | Source |
| August 2025 | Trico Community Unit School District #176 | Education | Illinois, United States | 150 | No | Source |
| June 2025 | O&G Adelaide Pty Ltd | Healthcare | Adelaide, Australia | — | Unknown | Source |
| June 2025 | Taos County | Government | New Mexico, United States | — | Unknown | Source |
| May 2025 | Union County | Government | Ohio, United States | 45,487 | Yes | Source |
| April 2025 | The Derby High School | Education | Bury, United Kingdom | — | Unknown | Source |
| March 2025 | Baltimore City State's Attorney's Office | Government | Maryland, United States | — | Unknown | Source |
| February 2025 | Vitenas Cosmetic Surgery, PA | Healthcare | Texas, United States | 31,852 | Unknown | Source |
| September 2024 | Accounting & Advisory Services, P.A. | Finance | Kansas, United States | 1,262 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Kairos's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.