Kairos Extortion Group: Defending Against Encryptionless Data-Theft Campaigns

---
title: Potential Extortion Note Creation Without Encryption
id: 8a4d2e10-1b3c-4f9e-8a1d-2c3b4d5e6f7a
status: experimental
description: Detects the creation of text files commonly used for ransom notes (README, RESTORE) in user directories, potentially indicating an extortion-only group.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1566.001
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\README'
      - '\RESTORE'
      - '\HOW_TO_DECRYPT'
      - '\HOW_TO_RECOVER'
      - '\YOUR_DATA'
    TargetFilename|endswith:
      - '.txt'
      - '.html'
      - '.hta'
  condition: selection
falsepositives:
  - Legitimate software documentation rarely placed in root/user folders directly.
level: high
---
title: Suspicious Rclone Cloud Synchronization Activity
id: 9b5e3f21-2c4d-5e0f-9b2e-3d4c5e6f7a8b
status: experimental
description: Detects the execution of rclone, a tool often abused by threat actors for data exfiltration to cloud storage, with parameters specifying synchronization or copying.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'sync'
      - 'copy'
      - 'config create'
  condition: selection
falsepositives:
  - Administrators using rclone for legitimate backup operations.
level: medium
---
title: High Volume Data Egress via File Transfer Tools
id: 0c6f4a32-3d5e-6f1a-0c3f-4e5d6f7a8b9c
status: experimental
description: Detects execution of known file transfer tools (WinSCP, FileZilla) often used for data staging and exfiltration.
references:
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winscp.exe'
      - '\filezilla.exe'
      - '\pscp.exe'
  condition: selection
falsepositives:
  - Legitimate administrative file transfers.
level: low

// Hunt for creation of potential extortion note files on endpoints
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any ("README", "RESTORE", "RECOVER", "DECRYPT", "your_data", "all_files")
| where FolderPath contains "C:\Users\" // User context is crucial
| where InitiatingProcessAccountName != "SYSTEM"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| extend Ts = Timestamp
| order by Ts desc


// Hunt for large outbound network connections indicative of exfiltration
// Adjust ThresholdBytes based on your baseline (e.g., 500MB)
let ThresholdBytes = 500000000;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess" 
| where RemotePort in (443, 21, 22, 445, 8443) // Common ports for transfer
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, RemoteUrl, InitiatingProcessFileName
| where TotalBytesSent > ThresholdBytes
| project DeviceName, RemoteUrl, InitiatingProcessFileName, TotalBytesSent
| order by TotalBytesSent desc

-- Hunt for extortion note artifacts on the file system
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs="C:\Users\*\*.txt")
WHERE
    -- Search for common extortion keywords in the filename or content (if indexed)
    FullPath =~ "(?i)(readme|restore|recover|decrypt|your_data)"
    OR Size < 50000 // Notes are usually small text files
LIMIT 100

<#
.SYNOPSIS
    Scan for extortion artifacts and suspicious tools.
.DESCRIPTION
    Searches user directories for ransom notes and checks for presence of high-risk exfiltration tools.
#>

$RiskFiles = @("README.txt", "README.html", "RESTORE_FILES.txt", "HOW_TO_RECOVER.html")
$RiskPaths = @("C:\Users\", "C:\Temp\")
$RiskProcesses = @("rclone.exe", "winscp.exe", "filezilla.exe")

Write-Host "[+] Starting Extortion Artifact Scan..." -ForegroundColor Cyan

# Scan for suspicious file names
foreach ($Path in $RiskPaths) {
    if (Test-Path $Path) {
        Write-Host "[?] Scanning $Path for potential extortion notes..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
            Where-Object { $RiskFiles -contains $_.Name } | 
            Select-Object FullName, LastWriteTime, Length | 
            Format-Table -AutoSize
    }
}

# Check for running or installed high-risk tools
Write-Host "[?] Checking for high-risk exfiltration processes..." -ForegroundColor Yellow
foreach ($Proc in $RiskProcesses) {
    $Check = Get-Process -Name $Proc.Replace(".exe", "") -ErrorAction SilentlyContinue
    if ($Check) {
        Write-Host "[!] ALERT: Suspicious process found running: $($Proc)" -ForegroundColor Red
    }
}

# Check Common Program Paths for tools
$CommonPaths = @("${env:ProgramFiles}", "${env:ProgramFiles(x86)}", "$env:LOCALAPPDATA")
foreach ($Path in $CommonPaths) {
    foreach ($Tool in $RiskProcesses) {
        $FullPath = Join-Path -Path $Path -ChildPath "*\$Tool"
        if (Test-Path $FullPath) {
            Write-Host "[!] ALERT: Suspicious tool found at: $FullPath" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Green