Skip to main content
Darkfield

Operator dossier

killsec is a ransomware operator currently active on public leak sites. Darkfield has indexed 281 public victims claimed by this operator between March 21, 2024 and June 3, 2026. killsec is a relatively new ransomware group that emerged in March 2024, operating with apparent financial motivations and demonstrating broad targeting across multiple geographic regions and industry sectors. The group's origin and potential state affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their targeting pattern suggests opportunistic rather than geopolitically motivated operations. With 276 documented victims primarily concentrated in the United States, India, the United Kingdom, Brazil, and Belgium, killsec appears to focus heavily on healthcare, technology, business services, and financial sectors, indicating either specific tooling designed for these environments or opportunistic targeting of organizations with valuable data and high pressure to restore operations quickly. Given the group's recent emergence and the lack of detailed technical analysis from established cybersecurity firms like Mandiant or law enforcement advisories from CISA or FBI, specific details about their attack methodology, initial access vectors, encryption techniques, and extortion tactics have not been publicly documented in authoritative sources. The group remains active as of current reporting, though the limited intelligence profile suggests they may be either a smaller operation or one that has not yet attracted significant attention from major threat intelligence organizations despite their substantial victim count.

Most-targeted sectors

Most-affected countries

Recent disclosures by killsec

Most recent 150 of 281 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for killsec →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

killsec

281 victims indexed · first seen 2 years ago · last activity 1 month ago

281
Victims indexed
#32 of 364 tracked operators
2y 3m
Active period
Mar 2024 → Jun 2026
10
Countries hit
top US · 85

At a glance

Status
active
First seen
2 years ago
Last activity
1 month ago
Onion sites
1 known endpoint
Primary sector
Not Found · 73 hits

About

killsec is a relatively new ransomware group that emerged in March 2024, operating with apparent financial motivations and demonstrating broad targeting across multiple geographic regions and industry sectors. The group's origin and potential state affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their targeting pattern suggests opportunistic rather than geopolitically motivated operations. With 276 documented victims primarily concentrated in the United States, India, the United Kingdom, Brazil, and Belgium, killsec appears to focus heavily on healthcare, technology, business services, and financial sectors, indicating either specific tooling designed for these environments or opportunistic targeting of organizations with valuable data and high pressure to restore operations quickly. Given the group's recent emergence and the lack of detailed technical analysis from established cybersecurity firms like Mandiant or law enforcement advisories from CISA or FBI, specific details about their attack methodology, initial access vectors, encryption techniques, and extortion tactics have not been publicly documented in authoritative sources. The group remains active as of current reporting, though the limited intelligence profile suggests they may be either a smaller operation or one that has not yet attracted significant attention from major threat intelligence organizations despite their substantial victim count.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

23 months
2024-03-01T00:00:00+00:00 · 52024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 22024-07-01T00:00:00+00:00 · 32024-08-01T00:00:00+00:00 · 152024-09-01T00:00:00+00:00 · 132024-10-01T00:00:00+00:00 · 332024-11-01T00:00:00+00:00 · 332024-12-01T00:00:00+00:00 · 282025-01-01T00:00:00+00:00 · 92025-02-01T00:00:00+00:00 · 222025-03-01T00:00:00+00:00 · 172025-04-01T00:00:00+00:00 · 202025-05-01T00:00:00+00:00 · 52025-06-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 22025-09-01T00:00:00+00:00 · 322025-10-01T00:00:00+00:00 · 92025-11-01T00:00:00+00:00 · 22025-12-01T00:00:00+00:00 · 82026-01-01T00:00:00+00:00 · 22026-02-01T00:00:00+00:00 · 52026-03-01T00:00:00+00:00 · 8
2024-03-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
85
🇮🇳 India
48
🇬🇧 United Kingdom
11
🇧🇷 Brazil
10
🇧🇪 Belgium
8
🇷🇴 Romania
6
🇦🇺 Australia
6
🇹🇭 Thailand
5
United States dossier →India dossier →United Kingdom dossier →Brazil dossier →

Top sectors

Healthcare
39
Technology
37
Business Services
29
Financial
16
Financial Services
14
Manufacturing
13
Education
13
Transportation/Logistics
11
Healthcare dossier →Technology dossier →Business Services dossier →Financial dossier →

Recent victims

Loading…

Onion infrastructure

1 known
  • http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time killsec posts a victim.

Add killsec to your watchlist — Pro pings you within 5 minutes of any new killsec leak-site post, Telegram callout, or affiliate-rebrand inference.