Loading story…
A U.S. government entity reportedly paid about $1 million in Bitcoin to the Kairos group after attackers allegedly stole more than 2 TB of data and threatened to publish it. A Ransom-ISAC case study said the incident showed no confirmed signs of file encryption, a ransomware locker, or any decryption demand, indicating a pure data-theft extortion operation rather than a traditional ransomware attack. Negotiations reportedly lasted about a month, with Kairos reducing its demand from $3 million to a final payment of roughly 9.44 BTC.
The victim was not formally identified, but chat logs and file-name clues cited in the reporting align with Union County, Ohio, which disclosed a 2025 breach affecting 45,487 residents and staff, though neither the county nor Kairos confirmed the connection. Blockchain tracing found the payment was quickly split and routed toward deposit addresses linked to Bybit, OKX, and BELQI, offering investigative leads but not definitive attribution. The case underscores the rise of encryption-less extortion, where organizations face pressure to pay despite having no technical way to verify that stolen data was actually deleted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Blockchain tracing found the 9.44 BTC payment was quickly split and routed toward deposit addresses or wallets associated with Bybit, OKX, and BELQI. The reporting says these flows provided investigative leads but did not by themselves prove attribution.
Union County, Ohio disclosed a May 2025 incident affecting 45,487 residents and staff/employees. Later reporting said details in leaked Kairos negotiation materials aligned with this disclosed intrusion, though the linkage was not officially confirmed.
After a roughly month-long negotiation in which Kairos reportedly lowered its demand from $3 million, the victim paid about $1 million, or roughly 9.44 BTC, to prevent stolen files from being leaked. The case was described as a data-theft extortion incident with no confirmed evidence of file encryption or a decryption demand.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourceransom-isac.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
Jun 29, 2026
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026