Loading threat actor…
Radiant is a newly emerged cybercriminal extortion and ransomware group active in 2025. It is best known for the attack on Kido International, a nursery and preschool operator, in which the group claimed to have stolen sensitive data relating to thousands of children and their families and used that material for coercive pressure. Reported aliases include Radiant Group. Public reporting also links the group to a claimed attack on an unnamed hospital in Minnesota and to additional leak-site victim listings in late 2025. Radiant’s operations are characterized by exfiltration-led extortion and public shaming through a leak site. In the Kido incident, the group reportedly published children’s photographs and personal profiles, issued a cryptocurrency ransom demand, and directly contacted parents to intensify pressure on the victim organization. Reporting also indicates the group threatened broader disclosure and used staged public exposure as leverage. These behaviors align with data-theft extortion and victim-harassment tactics, and some reporting describes the group as conducting both single- and double-extortion operations. The Kido intrusion was reported as involving compromised employee credentials obtained through an initial access broker, with stolen data hosted in a third-party childcare software environment used by the victim. Across reporting, Radiant is associated with credential-based intrusion, data theft, extortion, leak-site operations, and post-compromise coercion. The group has also been described as threatening to contact regulators, associates, or other external parties to increase pressure, consistent with broader triple-extortion style behavior, although that tactic is less firmly established than its direct harassment and leak-site activity. Radiant drew unusual condemnation from both defenders and other cybercriminal actors because of its handling of children’s data. After backlash, the group claimed that a partner or affiliate had violated internal rules by targeting a childcare organization, removed previously leaked Kido material, and asserted that it would no longer target organizations holding children’s information. UK law enforcement later arrested two 17-year-old suspects in connection with the Kido attack and extortion attempt, and reporting correlates Radiant’s apparent disappearance in October 2025 with that action. The available evidence supports classification of Radiant as a financially motivated criminal extortion actor rather than a state-sponsored group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Extortion actor noted for extreme personal-data targeting: allegedly leaked photos and identifying details of children/staff to maximize psychological pressure; activity reportedly ceased after UK law-enforcement action.
Claimed responsibility for attacks (including a London nurseries chain), involving theft of personal data of children/families and attempted extortion for ransom paid in Bitcoin.
Radiant is a ransomware group known for leaking sensitive personal data, including images and contact details of children, as part of their extortion tactics.
Radiant is a ransomware group actively targeting organizations in Germany and globally, with recent attacks on Magna Foodservice and other entities. They use leak sites for extortion and data publication.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.