radiant

Executive Summary

Radiant is a financially motivated ransomware group that emerged in September 2025. Known for conducting double- and single-extortion attacks, Radiant gained notoriety after attacking the UK childcare provider Kido International, exposing sensitive information of over 8,000 children. The group operates without known affiliates and has demonstrated a clear focus on maximizing financial gain through ransomware campaigns.

Goals & Targeting

Radiant's primary motivation is financial gain, achieved through the deployment of ransomware and double-extortion schemes. The group targets sectors where data sensitivity and potential for victim shaming can maximize pressure to pay ransoms. Their selection of Kido International as a target highlights an apparent preference for industries with significant public exposure and high stakes—such as healthcare or education—and where data breaches could cause widespread harm. Radiant's targeting appears geographically unrestricted, but their attacks have occurred predominantly in regions with weaker cybersecurity defenses, particularly in Europe and North America.

Radiant is a recently emerged ransomware group with a primary focus on generating financial profit through extortion attacks. The group first gained prominence in September 2025, following an attack on the UK-based Kido International, a childcare provider. This incident involved not only the deployment of ransomware but also the exfiltration and publication of sensitive data, including photographs, names, and home addresses of children under their care. Radiant's attacks demonstrate a clear preference for double extortion tactics, where victims are pressured to pay twice: once to regain access to encrypted systems and again to prevent the disclosure of stolen data. The group has not been linked to any known affiliates, suggesting an independent operational model. WhileRadiant's geographic targeting appears broad, their attacks have caused significant impact due to the sensitive nature of their victim selection. The group's emergence coincides with a broader trend of ransomware-as-a-service (RaaS) models, though Radiant operates as a standalone entity rather than renting out their services to others.

Key Capabilities

• Ransomware deployment with double-extortion tactics
• Data exfiltration and victim shaming techniques
• Lateral movement within networks to identify high-value data
• Use of custom ransomware or known ransomware families
• Staging infrastructure for command-and-control (C2) communication

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Radiant's campaigns demonstrate a focus on high-impact targets with the potential for significant reputational damage. The group's operational timeline is still emerging, but their targeting of healthcare and education sectors suggests an intent to maximize emotional and financial pressure on victims. Radiant appears to favor persistent access and lateral movement within networks to identify and exfiltrate sensitive data before initiating encryption and demanding ransoms. Notable past operations include the Kido International attack, which highlighted their preference for victim shaming alongside traditional ransom demands.

IOC Patterns

• Spear-phishing emails with malicious links or attachments
• Ransomware payloads delivered via C2 servers
• Exfiltration of sensitive data before encryption
• Use of established malware frameworks like Qbot
• Encryption of files with custom or known ransomware

Recommended Actions

• Implement robust backup and recovery solutions to minimize the impact of ransomware attacks.
• Conduct regular employee training on identifying phishing attempts and suspicious emails.
• Monitor for unusual network activity, particularly lateral movement and data exfiltration patterns.
• Apply endpoint detection and response (EDR) solutions to identify and block known ransomware behaviors.
• Ensure strong access controls and encryption practices for sensitive data repositories.

Suggested Tags