[threat-actors] Add Kairos

clusters/threat-actor.json

@@ -17433,6 +17433,16 @@
       },
       "uuid": "c2f1f2e3-9573-49be-b01e-6ffff9a9571b",
       "value": "TA455"
+    },
+    {
+      "description": "Kairos is an extortion group that emerged with a data-leak site on 13 November 2024, claiming attacks against six organizations, primarily in the US healthcare sector. The group is financially motivated, demanding Bitcoin payments for the secure deletion of stolen files and threatening to leak data if victims do not comply. While no specific TTPs are publicly known, common techniques among extortion groups include phishing and scanning for exposed internet-facing devices. There is a potential link to a user on a Russian-language cybercriminal forum who shares a post-exploitation script, but attribution remains uncertain.",
+      "meta": {
+        "refs": [
+          "https://www.cyjax.com/resources/blog/an-elephant-in-kairos-data-leak-site-emerges-for-new-extortion-group/"
+        ]
+      },
+      "uuid": "4d3c9666-6e08-4186-854c-cc0f8c28f5b6",
+      "value": "Kairos"
     }
   ],
   "version": 320