Ransomware Group intelligence
Killsec
ActiveTrack Killsec with 293 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Killsec is tracked by Breach House as a ransomware group with 293 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Up checked 1h ago | ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion |
| Leak location 3 | Onion service | Up checked 1h ago | ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion |
| Leak location 1 | Onion service | Down checked 1h ago | kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion |
Top Activity Sectors (16)
- Not identified 106
- Communication / Marketing 39
- Services 30
- Healthcare / Pharma 27
- Finance / Legal / Insurance 24
- Retail / E-commerce 11
- Education 10
- IT 9
- Public Sector 6
- Hospitality / Food & Beverage / Tourism 6
- Transportation / Travel / Logistics 6
- Construction / Real Estate 3
- Energy 3
- Telecommunications 2
- Manufacturing / Engineering 2
- Agriculture / Food 1
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Killsec, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: killsec executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: killsec modifies Windows Registry Run Keys to ensure malware execution upon system reboot for persistence.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: killsec disables security tools like EDR agents and antivirus software to prevent detection and response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.002 Software Packing Stealth
What they do: killsec packs its malware binaries to evade signature-based detection by security vendors.
What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
-
T1070.004 File Deletion Stealth
What they do: killsec deletes Volume Shadow Copies and backup directories via vssadmin and command-line tools to eliminate recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: killsec accesses and dumps LSASS memory using credential-extraction tools to harvest user credentials.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1018 Remote System Discovery Discovery
What they do: killsec performs remote system discovery via Nmap scans to map internal networks and identify high-value targets.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: killsec scans network shares using SMB tools to identify victim hosts and data repositories for targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: killsec leverages SMB/Windows Admin Shares for lateral movement across networked machines within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: killsec exfiltrates stolen data via encrypted C2 channels before deploying ransomware to maximize extortion leverage.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: killsec encrypts victim files using custom symmetric encryption routines targeting documents, images, and databases.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: killsec invokes system shutdown commands and service termination scripts to disrupt operational continuity.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (293)
Search, filter and paginate the victim timeline for Killsec. Showing 1–100 of 293.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Global Go id32054 View details | Peru | Services | ||
|
globalgo.com.pe operates within the Services sector based in Peru (PE). The entity represents a business offering services under its domain identity, with no verified operational details beyond its sector classification and geographic presence. This catalog entry classifies globalgo.com.pe as a ransomware victim within the threat-intelligence index. The association links the entity to killsec, a threat actor identified in cyber threat reporting. This listing supports security teams in tracking ransomware exposure patterns across regional service-sector organizations. Neutral documentation reflects the indexed status without confirming specific breach details, data loss, or recovery outcomes. |
|||||
| Ransomware | Global Go id32054 View details | Peru | Services | ||
|
[AI generated] N/A |
|||||
| Ransomware | cashcowboy id30809 View details | United States | Retail / E-commerce | — | |
|
Cashcowboy.net operates in the retail and e-commerce sector, providing services to customers in the United States. As an online platform, it offers various products and services to its customers. Cashcowboy.net was listed as a ransomware victim associated with killsec |
|||||
| Ransomware | cashcowboy id30809 View details | United States | Retail / E-commerce | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Bulwark Exterminating id30810 View details | United States | Services | — | |
|
Bulwark Exterminating is a services company based in the United States, providing exterminating services to its clients. As a part of the services sector, the company operates in the pest control industry, offering solutions to residential and commercial customers. Bulwark Exterminating was listed as a ransomware victim associated with killsec. |
|||||
| Ransomware | Bulwark Exterminating id30810 View details | United States | Services | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | origins ivf id30811 View details | India | Healthcare / Pharma | — | |
|
Origins IVF is a healthcare and medicine provider based in India, offering services related to in vitro fertilization and other fertility treatments. As a part of the healthcare sector in India, Origins IVF plays a role in providing medical services to individuals and families. Origins IVF was listed as a ransomware victim associated with KillSec. |
|||||
| Ransomware | origins ivf id30811 View details | India | Healthcare / Pharma | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | csinsurance.mx id29574 View details | Mexico | Other | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | acehospital.in id29575 View details | India | Other | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | dsdlawfirm.com id29140 View details | United States | Other | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | mrs holdings id28999 View details | Nigeria | Other | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Medical PAY id28372 View details | Japan | Finance / Legal / Insurance | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | hospitalvetdiadema24h.com.br id27398 View details | Brazil | Healthcare / Pharma | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | palram.com id27397 View details | Israel | Other | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | meena health id27318 View details | Healthcare / Pharma | — | ||
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | NextCapitalTrust id27317 View details | Communication / Marketing | — | ||
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | shlomo bit id27241 View details | Israel | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | MyFair id27112 View details | Korea, Republic of | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | MedicalGPT id27111 View details | United States | Healthcare / Pharma | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | yurdriversnetwork id27110 View details | United States | Telecommunications | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | primaria ungheni id26834 View details | Romania | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | onlinedivorcetexas.com id26700 View details | United States | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Orain.io id26605 View details | Spain | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Getly id26374 View details | Nigeria | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | brooklyn group id26218 View details | United States | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | X-CD Technologies id25731 View details | United States | IT | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | publicsafety.ohio.gov id25402 View details | United States | Public Sector | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | grade results id25083 View details | United States | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | republica federative do brasil id24776 View details | Brazil | Public Sector | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | dabafinance.com id24761 View details | United Kingdom | Finance / Legal / Insurance | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | screenate id24631 View details | India | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | koncept law id24630 View details | India | Finance / Legal / Insurance | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | caryanams id24629 View details | India | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | playroll id24628 View details | United Kingdom | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | seajob id24627 View details | India | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Rama Judicial id24262 View details | Colombia | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | Force Brokerage id23909 View details | United States | Communication / Marketing | — | |
|
Price ??? Disclosures 0/1 |
|||||
| Ransomware | National Institute of Administratio... id23312 View details | Romania | Education | — | |
|
The National Institute of Administration (INA) is a Romanian public institution dedicated to the professional development and training of civil servants and personnel in public administration. Operating under the coordination of the Ministry of Development, Public Works, and Administration, INA plays a pivotal role in enhancing the efficiency, transparency, and effectiveness of public services across Romania. |
|||||
| Ransomware | Badger Popcorn And Concession Suppl... id23311 View details | United States | Communication / Marketing | — | |
|
Badger Popcorn & Concession Supply Company specializes in providing high-quality concession supplies, with a focus on gourmet popcorn and related equipment. The company offers a diverse range of products, including popcorn snacks, cleaning supplies, soft serve and ice cream machines, and slush puppie equipment. As a Medallion Dealer for Gold Medal Products Co., Badger Popcorn is committed to delivering exceptional products and services, catering to both individual customers and businesses. The company is also known for its gift tins, featuring gourmet popcorn options, making it a go-to destination for unique gift ideas. |
|||||
| Ransomware | Economy Restaurant Equipment And Su... id23310 View details | United States | Hospitality / Food & Beverage / Tourism | — | |
|
Economy Restaurant Equipment & Supply Company is a premier dealer of restaurant and food service equipment in Southern California, specializing in a comprehensive range of products and services. The company offers professional kitchen equipment, design and planning services, and holds auctions for used equipment. Economy Restaurant Equipment stocks major brands such as Wolf, Vulcan, and True, providing everything from cooking appliances to dining supplies. With over 20 years of experience, the company is dedicated to helping food service establishments enhance their operations through quality products and expert design solutions. |
|||||
| Ransomware | J AND S Electrical And Lighting Sup... id23309 View details | United States | Services | — | |
|
J&S Electrical and Lighting Supply, LLC is a locally owned distributor specializing in electrical and lighting products, dedicated to providing exceptional service and support to its customers. Located in Athens, Georgia, the company offers a wide range of electrical supplies and lighting solutions to meet the needs of residential and commercial clients. Committed to customer satisfaction, J&S Electrical and Lighting Supply operates Monday through Friday, ensuring accessibility for all customers seeking quality electrical solutions. |
|||||
| Ransomware | FAAB Invest Advisors Private Limite... id23308 View details | India | Communication / Marketing | — | |
|
FAAB Invest Advisors Private Limited operates a green investment platform offering fractional ownership in sustainable assets such as electric mobility, farmlands, and renewable energy projects. The company focuses on providing retail investors access to environmentally-friendly, asset-backed investment opportunities with potential for returns and portfolio diversification. |
|||||
| Ransomware | DUC App: Global Money Movement, Sim... id23307 View details | Canada | Retail / E-commerce | — | |
|
DUC App is a leading financial technology platform that empowers individuals and businesses to manage global payments and currency exchange effortlessly. Offering instant transfers, international mobile top-ups, cryptocurrency transactions, and robust API integrations for e-commerce, DUC App delivers a secure, user-friendly experience across web, iOS, and Android devices -- The data includes, but is not limited to, clients' home addresses, phone numbers, transaction histories, email addresses, public and private crypto address keys, verified documents, passports, IDs, and more. If the company refuses to cooperate, we will release all information. |
|||||
| Ransomware | iCare Software id23306 View details | United States | IT | — | |
|
Founded in 1997, iCare Software, based in the United States, delivers innovative management solutions for childcare and afterschool programs. Serving childcare centers, preschools, afterschool programs, and multi-site operations, iCare automates critical tasks like attendance tracking, staff scheduling, tuition collection, and compliance reporting. Its unique offerings include AI-driven analytics, business intelligence dashboards, and CRM tools to boost enrollment and staff retention. With seamless data migration and robust back-end technology, iCare empowers providers to focus on quality care while streamlining operations and driving growth. |
|||||
| Ransomware | Vanan Online Services id23305 View details | United States | Services | — | |
|
Vanan Online Services offers a comprehensive range of language services, including transcription, translation, captioning, subtitling, voice-over, and typing. They cater to individuals and businesses across various industries, providing solutions in over 100 languages with a focus on quality and affordability. With a commitment to seamless project management and customer support, they ensure timely deliveries and customer satisfaction. The company has built a strong reputation over a decade of service, making them a trusted partner in the language services field. |
|||||
| Ransomware | KillSec 4.0 id22807 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | WalletKu Indompet Indonesia id22621 View details | Indonesia | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | XChief / ForexChief id22620 View details | Virgin Islands, British | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Study Gate id22583 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Rainwalk Technology id22525 View details | Canada | IT | ||
|
No additional victim description available. |
|||||
| Ransomware | Fractalite id22524 View details | United Kingdom | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | BEHCA id22523 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | VTK Legal id22522 View details | Poland | Finance / Legal / Insurance | ||
|
No additional victim description available. |
|||||
| Ransomware | AX CAPITAL id22521 View details | United Arab Emirates | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | FDB Collections id22520 View details | Greece | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | MortDash id22519 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | Scanbo id22518 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | UwayApply id22517 View details | Korea, Republic of | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Top4Fans id22516 View details | France | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Cadorim id22515 View details | Belgium | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Allure Clinics id22428 View details | Australia | Healthcare / Pharma | ||
|
No additional victim description available. |
|||||
| Ransomware | HappyTenant id22382 View details | United Arab Emirates | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | BlockBets Casino id22290 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | Princeps Credit Systems Limited id22260 View details | Nigeria | Finance / Legal / Insurance | ||
|
No additional victim description available. |
|||||
| Ransomware | BusOnlineTicket Thailand id22259 View details | Thailand | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | 1 ACT Driving Schools id22258 View details | United States | Education | ||
|
No additional victim description available. |
|||||
| Ransomware | BFLI id22256 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Docklyne id22255 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | Accelerated Academy id22253 View details | United States | Education | ||
|
No additional victim description available. |
|||||
| Ransomware | AVA Senior Connect id22191 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Nathan And Nathan id22190 View details | United Arab Emirates | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Nathan id22167 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | GPS Trackit id22163 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Archer Health id22162 View details | United States | Healthcare / Pharma | ||
|
No additional victim description available. |
|||||
| Ransomware | Suiza Lab id22157 View details | Peru | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | eMedicoERP id22155 View details | India | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | GoTelemedicina id22154 View details | Colombia | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | MedicSolution+ id22153 View details | Brazil | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | DUC App: Global Money Movement, Simplified id21846 View details | United States | Services | ||
|
No additional victim description available. |
|||||
| Ransomware | Doctocliq id21821 View details | Mexico | Communication / Marketing | ||
|
En Doctocliq ayudamos a miles de doctores en 19 países a gestionar sus consultorios de forma más eficiente, rentable y humana, con una plataforma que conecta agenda, expediente clínico, finanzas y comunicación con pacientes mediante inteligencia artificial. Estamos construyendo la infraestructura digital para que millones de profesionales de la salud en Latinoamérica lideren su propio crecimiento. Nuestro equipo crece con la misma velocidad que nuestra visión: si te apasiona la tecnología, el impacto social y el trabajo colaborativo, aquí puedes transformar la salud junto a nosotros. |
|||||
| Ransomware | NewGen id20646 View details | India | Transportation / Travel / Logistics | ||
|
No additional victim description available. |
|||||
| Ransomware | StudentKare id20645 View details | India | Education | ||
|
No additional victim description available. |
|||||
| Ransomware | Novaria id20231 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Sama id20230 View details | Italy | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Constructive Building Solutions id20229 View details | United States | Construction / Real Estate | ||
|
No additional victim description available. |
|||||
| Ransomware | Medswana id20143 View details | Botswana | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | SNS SYSTEM id19766 View details | India | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Enflame Technology id19229 View details | China | IT | ||
|
No additional victim description available. |
|||||
| Ransomware | Brügger Architekten AG id18906 View details | Switzerland | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Royal Saudi Air Force id18905 View details | Saudi Arabia | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Collective Architecture id18904 View details | United Kingdom | Construction / Real Estate | ||
|
No additional victim description available. |
|||||
| Ransomware | IMA Global id18903 View details | United States | Services | ||
|
No additional victim description available. |
|||||
| Ransomware | US BioTek Laboratories id18902 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | 747 Studios id18893 View details | Germany | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | BenefitElect id18892 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Ocuco id18891 View details | Ireland | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | Workers Informática Ltda id18890 View details | Brazil | Services | ||
|
No additional victim description available. |
|||||
| Ransomware | Testima Engineering id18889 View details | Manufacturing / Engineering | |||
|
No additional victim description available. |
|||||
| Ransomware | Brella id18888 View details | United States | Other | ||
|
No additional victim description available. |
|||||