Extortion Without Encryption: The Kairos $1M Government Case

The shift away from encryption makes sense from the attacker's perspective—less chance of triggering 'shutdown' procedures and easier to stay under the radar. In our SOC, we've shifted focus to DLP anomalies rather than just waiting for BitLocker alerts. The scary part is that without the encryption 'kick' that wakes up the user, these breaches can go undetected for months.

We had a similar incident last year, though on a much smaller scale. The group skipped the ransomware and just sent us proof of exfiltrated PII. We refused to pay, and they leaked it. The recovery cost was almost entirely legal/PR, not IT restoration. It changes the calculus; paying doesn't get your systems back, it just buys silence. Silence is expensive, but is it worth $1M?

Good catch on the LOLbins angle. If they aren't packing a ransomware binary, they are likely living off the land to move data. I'd add monitoring for unsigned binaries writing to temp directories and then immediately being read by network processes. This is classic staging behavior that often flies under the radar if you're only looking for malicious execution.

This highlights the need for behavioral network analysis. Since they aren't encrypting files on disk, we can't rely on static IOCs. Instead, look for anomalies in SMB connections or sudden spikes in upload traffic to cloud storage. We started hunting for powershell.exe initiating web requests, a common exfil method. You can hunt for this with KQL:

ProcessCreate
| where FileName =~ "powershell.exe"
| where CommandLine contains "Invoke-WebRequest" or CommandLine contains "IEX"

This helps catch the staging phase before data leaves the perimeter.

Agreed, the pivot to pure extortion changes the game. Since they likely gained initial access via phishing to avoid binary detection, don't overlook outbound email rules. Attackers often configure these to silently exfiltrate data before the SOC catches the network traffic.

Here is a quick KQL hunt for suspicious rule creation:

DeviceEvents
| where ActionType == "EmailRuleCreated"
| project DeviceName, AccountName, AdditionalFields

That’s a scary precedent. To catch the data staging phase, we monitor for system-native archiving tools spawning from user shells instead of admin paths. It’s a common sign of "zipping" data for exfil before it hits the network. Here’s a KQL query we use to hunt for suspicious WinRAR or 7-Zip activity:

Process
| where ProcessVersionInfoCompanyName in ('Alexander Roshal', 'Igor Pavlov')
| where InitiatingProcessAccountSid !contains 'S-1-5-21-500'
| project Timestamp, DeviceName, FileName, ProcessCommandLine

The lack of encryption definitely complicates detection since we lose the obvious file modification artifacts. It's crucial to monitor for data staging behaviors instead. We often see attackers compressing data rapidly before exfil. This KQL query helps detect suspicious, password-protected archive creation which is a common precursor:

DeviceProcessEvents 
| where FolderPath endswith "\7z.exe" or FolderPath endswith "\winrar.exe" 
| where ProcessCommandLine contains "-p" and ProcessCommandLine contains "a"

Don't overlook exfiltration via legitimate cloud APIs. Attackers often leverage massive personal cloud storage accounts to bypass traditional C2 detection. In our MSP stack, we monitor for high-volume uploads to consumer-grade providers. You can spot this in Sentinel with a simple query for anomalies in upload volume:

DeviceNetworkEvents
| where RemoteUrl contains 'drive.google.com' or RemoteUrl contains 'mega.nz'
| summarize SentBytes = sum(SentBytes) by DeviceName, bin(Timestamp, 1h)
| where SentBytes > 50000000