Skip to main content
Darkfield

Operator dossier

Killsecurity is a ransomware operator currently active on public leak sites. Darkfield has indexed 277 public victims claimed by this operator between March 21, 2024 and May 15, 2026. Killsecurity is a relatively new ransomware group that emerged in March 2024, operating with apparent financial motivations and demonstrating rapid expansion in their victim targeting. The group's origin and affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their global targeting pattern suggests a sophisticated operation. Based on available victim data, Killsecurity has compromised 276 organizations primarily across the United States, India, United Kingdom, Brazil, and Belgium, with a particular focus on healthcare, technology, business services, and financial sectors. The group's attack methodology, encryption techniques, and specific tools remain undocumented in public threat intelligence reports from established security firms. Notable campaigns and high-profile victims have not been extensively documented by major cybersecurity organizations or law enforcement agencies, likely due to the group's recent emergence. Killsecurity appears to remain active as of current reporting, though comprehensive analysis of their operations is limited by the lack of detailed technical documentation from reputable threat intelligence sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by Killsecurity

Most recent 150 of 277 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Killsecurity →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Killsecurity

277 victims indexed · first seen 2 years ago · last activity 2 months ago

277
Victims indexed
#33 of 364 tracked operators
2y 2m
Active period
Mar 2024 → May 2026
10
Countries hit
top United States · 85

At a glance

Status
active
First seen
2 years ago
Last activity
2 months ago
Onion sites
2 known endpoints
Primary sector
Not Found · 73 hits

About

Killsecurity is a relatively new ransomware group that emerged in March 2024, operating with apparent financial motivations and demonstrating rapid expansion in their victim targeting. The group's origin and affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their global targeting pattern suggests a sophisticated operation. Based on available victim data, Killsecurity has compromised 276 organizations primarily across the United States, India, United Kingdom, Brazil, and Belgium, with a particular focus on healthcare, technology, business services, and financial sectors. The group's attack methodology, encryption techniques, and specific tools remain undocumented in public threat intelligence reports from established security firms. Notable campaigns and high-profile victims have not been extensively documented by major cybersecurity organizations or law enforcement agencies, likely due to the group's recent emergence. Killsecurity appears to remain active as of current reporting, though comprehensive analysis of their operations is limited by the lack of detailed technical documentation from reputable threat intelligence sources.

Timeline

23 months
2024-03-01T00:00:00+00:00 · 52024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 22024-07-01T00:00:00+00:00 · 32024-08-01T00:00:00+00:00 · 152024-09-01T00:00:00+00:00 · 132024-10-01T00:00:00+00:00 · 332024-11-01T00:00:00+00:00 · 332024-12-01T00:00:00+00:00 · 282025-01-01T00:00:00+00:00 · 92025-02-01T00:00:00+00:00 · 222025-03-01T00:00:00+00:00 · 172025-04-01T00:00:00+00:00 · 202025-05-01T00:00:00+00:00 · 52025-06-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 22025-09-01T00:00:00+00:00 · 322025-10-01T00:00:00+00:00 · 92025-11-01T00:00:00+00:00 · 22025-12-01T00:00:00+00:00 · 82026-01-01T00:00:00+00:00 · 22026-02-01T00:00:00+00:00 · 52026-03-01T00:00:00+00:00 · 8
2024-03-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
85
🇮🇳 India
48
🇬🇧 United Kingdom
11
🇧🇷 Brazil
10
🇧🇪 Belgium
8
🇦🇺 Australia
7
🇷🇴 Romania
6
🇨🇦 Canada
5
United States dossier →India dossier →United Kingdom dossier →Brazil dossier →

Top sectors

Healthcare
39
Technology
37
Business Services
29
Financial
16
Financial Services
14
Manufacturing
13
Education
13
Transportation/Logistics
11
Healthcare dossier →Technology dossier →Business Services dossier →Financial dossier →

MITRE ATT&CK

7 techniques · 5 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion
  • http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Killsecurity posts a victim.

Add Killsecurity to your watchlist — Pro pings you within 5 minutes of any new Killsecurity leak-site post, Telegram callout, or affiliate-rebrand inference.