Search threats, CVEs… ⌘K
← Back to all threat actors

killsec

KillSec originated as a hacktivist group aligned with the Anonymous movement before pivoting to ransomware operations in October 2023, officially launching a RaaS platform in June 2024 with an affiliate-friendly 88% revenue split, primarily targeting healthcare, financial services, and government sectors with over 250 documented victims as of late 2025.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-05-01
Last seen
2026-09-18
Sectors
technology, professional-services, healthcare, financial-services, manufacturing, retail-e-commerce, education, transportation, government-defense, hospitality, agriculture-and-food-production, energy-utilities
Status
Active

Threat intelligence assessment

At a glance

Facts

  • KillSec is a ransomware group with suspected members identified in Spain, the U.K., and Romania

Activity timeline

Facts

  • Investigation covers approximately 1,000 suspected attacks worldwide, with about 500 identified as successful
  • Spanish police identified more than 280 victims
  • The group obtained substantial ransom payments

Attribution assessment

Facts

  • KillSec began as a hacktivist group active since at least 2021 and transitioned to ransomware in October 2023
  • In June 2024, KillSec began offering its ransomware to affiliates under a ransomware-as-a-service model

Operational playbook

Facts

  • KillSec operated a data-theft extortion model, threatening to publish stolen data if ransoms were not paid

Initial access and identity targets

Facts

  • KillSec exploited software vulnerabilities and poorly secured edge devices and platforms to breach corporate systems

Capabilities and evasion

Facts

  • Members of the group used artificial intelligence to help build and maintain their ransomware infrastructure and identify potential victims

Infrastructure patterns

Facts

  • KillSec maintained a dark web data leak site hosted at https://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion/
  • The group's server infrastructure included five servers, including a main server and several servers used to store stolen data

Communication and pressure channels

Facts

  • Members sent victims samples of their own data as proof
  • Members threatened to sell data to other criminal groups if no ransom was paid

Named victims

Organizations

  • Catalan organization (attacked in early 2025)

Reported detail

Facts

  • Police in Spain arrested a 16-year-old suspected of running KillSec, with two additional suspects detained in the U.K. and Romania during coordinated international operations in September 2026.
  • KillSec conducted approximately 1,000 suspected attacks affecting more than 280 victims, stealing data and extorting ransom payments through threats to publish on a dark web leak site.
  • The group exploited software vulnerabilities, poorly secured cloud storage, and purchased dark web credentials to gain initial access to victim organizations.
  • Authorities seized the KillSec leak site, shut down 5 servers, secured 110 terabytes of data, and placed seizure notices on 5 domains.
  • KillSec evolved from a hacktivist group active since at least 2021 into a ransomware operation in October 2023 that offered ransomware-as-a-service to affiliates beginning June 2024.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
Indicator1 indicator cataloged

Types: domain.

Cataloged
Indicator4 indicators cataloged

Types: domain, tool.

First listed
Victim claimGiti Corp listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: onion.

Claimed
Victim claimGlobal Go listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimcashcowboy listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBulwark Exterminating listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimorigins ivf listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimkeralapolice.gov.in listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimcsinsurance.mx listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimacehospital.in listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimdsdlawfirm.com listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimmrs holdings listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMedical PAY listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimhospitalvetdiadema24h.com.br listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimpalram.com listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimmeena health listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNextCapitalTrust listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimshlomo bit listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMyFair listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMedicalGPT listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimyurdriversnetwork listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimprimaria ungheni listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimonlinedivorcetexas.com listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimOrain.io listed by killsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 103 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

killsecCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...