Shifting Kill Chains: Kairos and the Rise of 'Pure' Extortion

Just reviewed the Ransom-ISAC case study on the Kairos group hitting a US Government entity for a $1M payout. What stands out isn't the payment, but the methodology: zero encryption.

This was pure data-theft extortion. Krishnan's analysis suggests Kairos isn't a traditional ransomware crew (no locker, no decryptor). This is significant because it completely bypasses the availability aspect of the CIA triad. Backups, snapshots, disaster recovery plans—all irrelevant here. The attack surface shifts entirely to data exfiltration and access controls.

From a detection standpoint, this is harder to catch than locker ransomware. There's no mass file modification or obvious encryption processes to trigger alerts. They likely utilized standard administrative tools or slow-and-low exfiltration methods. We need to look for anomalies in data movement rather than file behavior.

I've updated my hunting queries to focus on large-scale archiving and egress. Here is a basic KQL query to identify suspicious compression activity often used in staging exfil:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("winrar.exe", "7z.exe", "tar.exe", "powershell.exe")
| where ProcessCommandLine contains "a" or ProcessCommandLine contains "Compress-Archive"
| where ProcessCommandLine contains ".zip" or ProcessCommandLine contains ".rar"
| extend ArchiveName = extract(@'(.*\.zip|.*\.rar)', 1, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ArchiveName
| order by Timestamp desc

The fact that they managed to negotiate $1M without holding systems hostage is a scary precedent for threat modeling. How are you all adjusting your DLP strategies to account for "non-ransomware" extortion crews?