THREAT ACTOR
KAIROS_
ActiveKAIROS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KAIROS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
137
Victims tracked
15 / 29
Active mirrors
2024-11-13
First listing
2026-10-14
Most recent
Victims by year
- 2026 35
- 2025 88
- 2024 14
Leak site mirrors
29 mirrors tracked, 15 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onionSBU snapshot · 2026-04-24 08:43 -
dwgxeoaqykd3zdkhol5xpgsqabp4lys4ea7qpl3f2b75b2sdsex644id.onion403 Forbidden snapshot · 2025-02-06 07:14 -
dngqgtcqcz5hgjvk4encs4vfyzucx3gtmov5a4eltvovux4nvazbx6ad.onion404 Not Found snapshot · 2025-05-27 19:15 -
usqa5b33yyc2u6kqf5au64cgj64acl2umtll76qutlmu7fckw6kh6wqd.onion403 Forbidden snapshot · 2026-05-04 09:21 -
esmhbczpio7umfnxog6bk23q3nok5fjuik2dttegvezqngg2oqklo7yd.onionFiles snapshot · 2026-06-02 10:12 -
2msn5sp3af3iy2ozj4235ccsb7pnpp4tkzyxdpzutyc2sxb3mujicfyd.onionFiles snapshot · 2025-07-25 05:05 -
pj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.onionsnapshot · 2025-08-01 15:15 -
vpj6dzqat4n4hwb625a4qjpuzd3bzrjgw5zlwa3l6uiazdwjcib3y6ad.oniontitle – Just another WordPress site snapshot · 2026-06-20 10:06 -
whodusp3s2z6rnenxhv7scc2w5fzsse5cmijll2vl7fo6ezk45zssjqd.onionFiles snapshot · 2026-05-13 10:19 -
khom5v7vmc2nomkze64dsbyenn3wlxkewg6dbsvt5sujl2rmrtfy4oid.onionIndex snapshot · 2026-05-26 09:03 -
nerqnacjmdy3obvevyol7qhazkwkv57dwqvye5v46k5bcujtfa6sduad.onionSBU snapshot · 2026-04-24 08:12 -
cvfgzmrcam5efoqx4lkdejv5nb6icocsla2tn2dzw4b7wlyf4luz7fyd.onionKairos snapshot · 2026-10-15 18:10 -
ijou7od6kfvgkx7d7r5h4o7uxnflpwbvjtifcbecnfyqgwa4jmesz5yd.onionIndex of / snapshot · 2026-10-15 18:00 -
lzdsbv45kxna7yxv2mbtbeknybyxyj5mwnj5a4trmuqbqlrtedzk2myd.onionIndex of / snapshot · 2026-10-15 18:09 -
ghioehacghmmpd2ric4su57lphcjehsc4det3rz3dursnwcc2onuodyd.onionIndex of / snapshot · 2026-10-15 18:09 -
pzstd4cygzmfydday55nsruut3ki7dlx5rvacwul66avdmfzz6i35nid.onionIndex of / snapshot · 2026-10-15 18:00 -
oawysds6jqvmxsfnwcf34w55nzchsle3ulflxupiqtw6erddkmzfhoqd.onionIndex of / snapshot · 2026-10-15 17:02 -
4wbfahcl7jw2ntvvs2hwjgvixtr6nvtqgyzvtxkizhhk3m54dtth4qid.onionIndex of / snapshot · 2026-10-15 18:02 -
lzc7esnmc75wlte5th57jqmadvbcqzsp7emvvuawtjnkdj5d3754dcad.onionIndex of / snapshot · 2026-10-15 18:08 -
nl6tfpchorctpthwpa5k6rl5wg7qczkhm3okou5ixkudb6ribvv4u3id.onionIndex of / snapshot · 2026-10-15 18:05 -
utjjgpcqhqaol772zk3nvvkbfxone3jnbtisoryucwwjawtrlqsd25id.onionIndex of / snapshot · 2026-10-15 18:05 -
ncpq6mubkvpiljwtvtv32zlbezp76ws3ac3a2hinygjahvcvggfwljyd.onionIndex of / snapshot · 2026-10-15 18:05 -
73mymwarbmye73dcd3rfvbfoqcui3ckxaruieib6kq6podbtmsmq4uad.onionsnapshot · 2026-09-29 21:03 -
jxrchotl2mfz7y3hugu5lklqfcj6xxxvkweydrshtnddfrqsw2c3qwqd.onionIndex of / snapshot · 2026-10-15 18:02 -
tmc5b5hk7274yougxfrozzrnt7rm73pwe5q5gys33jpqxegltu72qgqd.onionsnapshot · 2026-09-29 21:11 -
wr5kqxmnmdz5vl46mwkndohwhbaztdbv64ilc6ojb43q3nnkypyxsoqd.onionsnapshot · 2026-09-29 21:11 -
4k3widbkalyjjtsxp45246zfvsvsv2ie6vfynqorauy6oxo6ivt3rbad.onionIndex of / snapshot · 2026-10-15 18:05 -
svdishjust6dsjsfatvlz432utj4dy5wvvvlypspdp63jhtbgbcaisad.onionIndex of / snapshot · 2026-10-15 17:02 -
o2viabtf55prwxe7ass3gn6hs6nzmmpo7ks5ojtovkarb6u7yh5t6syd.onionIndex of / snapshot · 2026-10-15 18:00
Recent victims
The 50 most recent victims claimed by KAIROS. Total in the index: 137.
| Date listed | Victim | Description |
|---|---|---|
| 2026-10-14 | Oceania Digital Communications | Oceania Digital Communications (ODC Ltd) is a managed IT services prov… |
| 2026-10-01 | Slate Valley Unified School District | The Slate Valley Unified Union School District is a public school dist… |
| 2026-09-30 | Le Centre National de l'Expertise Hospitalière (CNEH) | Le Centre National de l'Expertise Hospitalière (CNEH) est une école de… |
| 2026-09-29 | Unique Repair Services | Unique Repair Services specializes in fast and reliable appliance repa… |
| 2026-09-22 | Krapf Group | Founded in 1942 and headquartered in West Chester, Pennsylvania, Krapf… |
| 2026-09-16 | Leisure Coast Kitchens | Leisure Coast Kitchens specializes in designing and installing high-qu… |
| 2026-09-02 | Ville de Libercourt | Libercourt is a commune in the Pas-de-Calais department of the Hauts-d… |
| 2026-08-20 | Ayuntamiento de Velilla de San Antonio | El Ayuntamiento de Velilla de San Antonio es el organismo oficial de g… |
| 2026-08-12 | Hightech Signs | Hightech Signs, Inc. is a full-service sign shop located in Charlottes… |
| 2026-07-30 | Warwick Fabrics | As one of the world’s leading textile and soft furnishing wholesalers,… |
| 2026-07-25 | Thermalex Inc | Thermalex specializes in aluminum extrusion solutions, offering high-e… |
| 2026-07-22 | LR Reed | LR Reed is a family-owned business with over 30 years of experience, s… |
| 2026-07-20 | College O'Sullivan de Québec | Collège O'Sullivan de Québec offers a variety of training programs bot… |
| 2026-06-14 | Commune De Camiers | Commune De Camiers is a company that operates in the Government indust… |
| 2026-05-15 | McCarthy Inc | McCarthy, Inc., based in Savannah, Georgia, has been providing quality… |
| 2026-05-12 | McParlane & Associates | cParlane & Associates, Inc. is headquartered in San Diego, CA and dire… |
| 2026-05-12 | ARWINI | Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARW… |
| 2026-05-12 | Ayuntamiento de Valdemoro | Ayuntamiento de Valdemoro is the municipal government of Valdemoro, a … |
| 2026-05-07 | Houk Air Conditioning | Houk AC is a leading HVAC repair and installation service based in Tex… |
| 2026-04-22 | Gregory Jewellers | Gregory Jewellers Pty Ltd is an Australian-owned, family-operated fine… |
| 2026-04-20 | Nordenta (a daughter company of LIFCO) | Nordenta og al dente nyhedsbrev Tilbud, produktnyheder og inspiration … |
| 2026-04-18 | Hazel Mercantile | Hazel Mercantile Limited (HML) is a multi-faceted organization with di… |
| 2026-04-18 | South Florida Injury Centers | South Florida Injury Centers was founded in 2000 by Dr. Brian Wilner, … |
| 2026-04-18 | Colonial Presbyterian Church | We are a community of believers who seek to be the Light of Christ in … |
| 2026-04-18 | Pullen Moving | Pullen Moving Company owns and operates two warehouses for storing hou… |
| 2026-04-18 | FriendlyCare Pharmacy | FriendlyCare Pharmacy offers a wide range of health and beauty product… |
| 2026-04-18 | Strata Republic | Strata Republic is a strata management company based in Sydney and Byr… |
| 2026-03-21 | Resch Maschinenbau | Wir setzen in unserer Position als Fertigungsspezialist neben einer qu… |
| 2026-03-16 | Folet & Rivoire | Notre équipe d'avocats expérimentés, est à même de répondre à la plupa… |
| 2026-03-10 | Institute of Social Security - Paraguay | The Instituto de Previsión Social or IPS is the institution responsibl… |
| 2026-03-03 | Katz Kantor Stonestreet & Buckner | Katz, Kantor, Stonestreet & Buckner serves all of West Virginia with c… |
| 2026-02-27 | Rockwood Retirement Communities | With more than 65 years of mission-driven nonprofit service and two th… |
| 2026-02-14 | Robbins Parking Service Ltd | Robbins got its start back in 1958 when Jack Robbins, an entrepreneur … |
| 2026-02-13 | The Marena Group | Contains a set of SQL databases For the past 30 years, Marena has bee… |
| 2026-02-12 | Seagrass Boutique Hospitality Group | Full Service Restaurants, Brand Development & Operating Specialists |
| 2025-12-19 | Aneticaid | Innovative Medical Technology Practically Applied Anetic Aid is a UK w… |
| 2025-12-19 | Archlou | We are the Catholic Church in Central Kentucky, disciples of Jesus Chr… |
| 2025-12-19 | Askyouraccountant | Accounting & Advisory Services provide strategic guidance beyond bookk… |
| 2025-12-19 | Austinsfs.com | Our team of integrated Accountants and Financial Planners strive to pr… |
| 2025-12-19 | Brownpacking | Brown Packing Co., Inc. is a beef packing company located in Gaffney, … |
| 2025-12-19 | Business.galesburg | Looking for a community that can cater to your needs while keeping you… |
| 2025-12-19 | Casperstruck | Caspers Truck Equipment is a leading distributor specializing in equip… |
| 2025-12-19 | Clayplattefamily | We are Clay Platte Family Medicine Clinic, PC. and we are the largest … |
| 2025-12-19 | Combinedpoolandspa | Combined Pool and Spa, in the city of Sioux Falls, SD, offers an incre… |
| 2025-12-19 | D-Line | D-Line is a UK company, based in Newcastle upon Tyne, with a global re… |
| 2025-12-19 | Dane Court | Dane Court is one of only a handful of schools in the UK to offer both… |
| 2025-12-19 | Delpackaging | At DEL Packaging, we take great pride in our work. Our incredible team… |
| 2025-12-19 | Dr Vitenas | Our Houston plastic surgery practice is dedicated to offering an excep… |
| 2025-12-19 | Durhamarts | Durham Arts Council, Inc. is a catalyst in the cultural development of… |
| 2025-12-19 | Eisenhowerlaw | Eisenhower Carlson PLLC is a full-service law firm based in Tacoma, Wa… |
CONFIRMED ATTACKS
Kairos confirmed attacks: 24 verified incidents
Ransomnews has verified 24 Kairos incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2024 to September 2026. United States accounts for 10 of them (42%), with victims recorded in 9 countries in total. The most affected sector is government, at 7 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 4; the outcome is unrecorded in the remaining 19. Where a figure was disclosed (5 cases), these incidents account for 80,276 exposed records.
24Verified incidents
9Countries
2024–2026Active range
20%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Kairos incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Slate Valley Unified School District | Education | Vermont, United States | — | No | Source |
| September 2026 | Ville de Libercourt | Government | Libercourt, France | — | Unknown | Source |
| August 2026 | Ayuntamiento de Velilla San Antonio | Government | Velilla San Antonio, Spain | — | Unknown | Source |
| July 2026 | LR Reed | Retail | Melbourne, Australia | — | Unknown | Source |
| May 2026 | Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (ARWINI) | Healthcare | Hannover, Germany | — | No | Source |
| May 2026 | Ayuntamiento de Valdemoro | Government | Valdemoro, Spain | — | No | Source |
| April 2026 | Friendly Care Management Pty Ltd (FriendlyCare Pharmacy) | Healthcare | Booval, Australia | — | Unknown | Source |
| April 2026 | Gregory Jewellers | Retail | Sydney, Australia | — | Unknown | Source |
| April 2026 | Nordenta A/S | Healthcare | Hørning, Denmark | — | Unknown | Source |
| March 2026 | Instituto de Previsión Social (IPS) | Government | Ascunción, Paraguay | — | Unknown | Source |
| February 2026 | Spokane United Methodist Homes d/b/a Rockwood Retirement Communities | Healthcare | Washington, United States | — | Unknown | Source |
| February 2026 | South Florida Injury Centers, Inc. | Healthcare | Florida, United States | 1,525 | Unknown | Source |
| February 2026 | Katz, Kantor, Stonestreet & Buckner, PLLC | Legal | West Virginia, United States | — | Unknown | Source |
| February 2026 | Seagrass Boutique Hospitality Group | Food and Beverage | Rhodes, Australia | — | Unknown | Source |
| September 2025 | Ekonomipoolen i Mark AB | Finance | Stockholm, Sweden | — | Unknown | Source |
| August 2025 | Melland High School | Education | Manchester, United Kingdom | — | Unknown | Source |
| August 2025 | Trico Community Unit School District #176 | Education | Illinois, United States | 150 | No | Source |
| June 2025 | O&G Adelaide Pty Ltd | Healthcare | Adelaide, Australia | — | Unknown | Source |
| June 2025 | Taos County | Government | New Mexico, United States | — | Unknown | Source |
| May 2025 | Union County | Government | Ohio, United States | 45,487 | Yes | Source |
| April 2025 | The Derby High School | Education | Bury, United Kingdom | — | Unknown | Source |
| March 2025 | Baltimore City State's Attorney's Office | Government | Maryland, United States | — | Unknown | Source |
| February 2025 | Vitenas Cosmetic Surgery, PA | Healthcare | Texas, United States | 31,852 | Unknown | Source |
| September 2024 | Accounting & Advisory Services, P.A. | Finance | Kansas, United States | 1,262 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Kairos's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.