Ransomware Group intelligence

Killsec

Active

Track Killsec with 293 published victims and 3 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 293 Known published victims in this dataset

First discovered 2024-03-21 Earliest victim discovery date

Last discovered 2026-08-23 Latest victim discovery date

Inactive since 9 days Days since the latest known victim

Top country United States 93 victims

Known locations 3 Leak or negotiation infrastructure tracked

Killsec is tracked by Breach House as a ransomware group with 293 published victims.

United States is currently the most targeted country in this dataset.

3 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Up checked 1h ago	`ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion`
Leak location 3	Onion service	Up checked 1h ago	`ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion`
Leak location 1	Onion service	Down checked 1h ago	`kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion`

Not identified 106
Communication / Marketing 39
Services 30
Healthcare / Pharma 27
Finance / Legal / Insurance 24
Retail / E-commerce 11
Education 10
IT 9
Public Sector 6
Hospitality / Food & Beverage / Tourism 6
Transportation / Travel / Logistics 6
Construction / Real Estate 3
Energy 3
Telecommunications 2
Manufacturing / Engineering 2
Agriculture / Food 1

Typical Attacks (12)

▼

MITRE ATT&CK does not currently catalogue Killsec, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: killsec executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: killsec modifies Windows Registry Run Keys to ensure malware execution upon system reboot for persistence.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: killsec disables security tools like EDR agents and antivirus software to prevent detection and response.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1027.002 Software Packing Stealth

What they do: killsec packs its malware binaries to evade signature-based detection by security vendors.

What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
T1070.004 File Deletion Stealth

What they do: killsec deletes Volume Shadow Copies and backup directories via vssadmin and command-line tools to eliminate recovery options.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1003.001 LSASS Memory Credential Access

What they do: killsec accesses and dumps LSASS memory using credential-extraction tools to harvest user credentials.

What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
T1018 Remote System Discovery Discovery

What they do: killsec performs remote system discovery via Nmap scans to map internal networks and identify high-value targets.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: killsec scans network shares using SMB tools to identify victim hosts and data repositories for targeting.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: killsec leverages SMB/Windows Admin Shares for lateral movement across networked machines within victim environments.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: killsec exfiltrates stolen data via encrypted C2 channels before deploying ransomware to maximize extortion leverage.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: killsec encrypts victim files using custom symmetric encryption routines targeting documents, images, and databases.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: killsec invokes system shutdown commands and service termination scripts to disrupt operational continuity.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Victims (293)

Search, filter and paginate the victim timeline for Killsec. Showing 101–200 of 293.

Type	Target	Discovered	Country	Business Category
Ransomware	Fancy Films id18887 View details	2025-04-01	Australia	Other
No additional victim description available. ID 18887
Ransomware	Lendco id18886 View details	2025-04-01	United Kingdom	Other
No additional victim description available. ID 18886
Ransomware	Nydegger + Finger AG id18885 View details	2025-04-01	Switzerland	Other
No additional victim description available. ID 18885
Ransomware	Dorel Home id18989 View details	2025-04-01	United States	Other
No additional victim description available. ID 18989
Ransomware	Dorel Home id18989 View details	2025-04-01	United States	Other
Dorelhome.com is the digital storefront of Dorel Home, a North American furniture brand headquartered in Quebec that designs and manufactures ready-to-assemble home furniture and commercial hardware for major retailers. Since 1962, the company has been globally recognized for producing quality furniture for every home, room, and lifestyle, operating across diverse furniture segments throughout North America. The brand offers a wide range of home furnishings and commercial hardware, serving major retailers with a focus on sustainable growth and customer-centric strategies. Dorel Home was listed as a ransomware victim associated with the threat actor killsec, with no confirmed details on stolen data or breach specifics. ID 18989
Ransomware	Hexicor id18988 View details	2025-04-01	Australia	Other
No additional victim description available. ID 18988
Ransomware	Hexicor id18988 View details	2025-04-01	Australia	Other
Hexicor is an Australian technology solutions provider headquartered in Brisbane, Queensland, with operations across Queensland, South Australia, and the Northern Territory. Its services include communications and digital access control, mobility and IoT, and managed IT services for business customers. Company profiles describe it as a national ICT integrator and technology leader serving organisations that need connectivity and operational support. It was listed as a ransomware victim associated with killsec. ID 18988
Ransomware	AAPG id18987 View details	2025-04-01	United States	Other
No additional victim description available. ID 18987
Ransomware	AAPG id18987 View details	2025-04-01	United States	Other
aapg.org is the official website of the American Association of Petroleum Geologists, a US-based international professional organization focused on petroleum geology and geoscience. It supports research, professional development, technical publishing, student programs, and local section activities for members in the energy and geology community. The organization publishes peer-reviewed content and provides educational and membership resources through its digital platform. It was listed as a ransomware victim associated with killsec. ID 18987
Ransomware	Hanna Global Solutions id18986 View details	2025-04-01	United States	Services
No additional victim description available. ID 18986
Ransomware	Hanna Global Solutions id18986 View details	2025-04-01	United States	Services
Workforce Junction is a US-based services company that describes itself as a boutique technology partner for benefit advisors and their employer clients. Its offerings include employee benefits support, customer success management, invoice reconciliation and audit services, payroll deduction reconciliation, enrollment support, and related HR services. The company’s site also presents it as a provider of solutions such as OE Express and The Benefits Desk, focused on improving benefits administration and operational efficiency. Workforce Junction was listed as a ransomware victim associated with KillSec. ID 18986
Ransomware	Flagship Press Flagship Press id18880 View details	2025-04-01		Communication / Marketing
No additional victim description available. ID 18880
Ransomware	Lee & Sakahara Architects id18858 View details	2025-03-31	United States	Other
No additional victim description available. ID 18858
Ransomware	Kyocera Document Solutions Europe id18857 View details	2025-03-31	Netherlands	Services
No additional victim description available. ID 18857
Ransomware	Design Design id18856 View details	2025-03-31	United States	Other
No additional victim description available. ID 18856
Ransomware	Lupin Limited id18752 View details	2025-03-28	India	Other
No additional victim description available. ID 18752
Ransomware	Precision Accounting Intl id18628 View details	2025-03-23		Finance / Legal / Insurance
No additional victim description available. ID 18628
Ransomware	SPARSH Hospital id18615 View details	2025-03-22	India	Healthcare / Pharma
No additional victim description available. ID 18615
Ransomware	Innovative Surfaces id18614 View details	2025-03-22		Other
No additional victim description available. ID 18614
Ransomware	Cayman National Bank id18579 View details	2025-03-21	Cayman Islands	Finance / Legal / Insurance
No additional victim description available. ID 18579
Ransomware	Officio Medical id18574 View details	2025-03-21	Germany	Healthcare / Pharma
No additional victim description available. ID 18574
Ransomware	Obra Play id18553 View details	2025-03-20	United States	Other
No additional victim description available. ID 18553
Ransomware	interiseworld.com id18552 View details	2025-03-20	United States	Other
No additional victim description available. ID 18552
Ransomware	Instituto de Ojos id18551 View details	2025-03-20	Argentina	Communication / Marketing
No additional victim description available. ID 18551
Ransomware	Harcourts Prime Properties id18483 View details	2025-03-18	United States	Communication / Marketing
No additional victim description available. ID 18483
Ransomware	Skyward Specialty Insurance id18337 View details	2025-03-11	United States	Finance / Legal / Insurance
No additional victim description available. ID 18337
Ransomware	Trymata id18336 View details	2025-03-11		Other
No additional victim description available. ID 18336
Ransomware	Wendy Wu Tours id18159 View details	2025-03-04	Australia	Other
No additional victim description available. ID 18159
Ransomware	Workforce Group id18116 View details	2025-03-02	Nigeria	Services
No additional victim description available. ID 18116
Ransomware	Shaghalni id17720 View details	2025-02-23	Egypt	Other
No additional victim description available. ID 17720
Ransomware	BluAgent Technologies, Inc id17719 View details	2025-02-23	United States	IT
No additional victim description available. ID 17719
Ransomware	Novi Community School District id17718 View details	2025-02-23	United States	Education
No additional victim description available. ID 17718
Ransomware	G&M Direct Hire id17717 View details	2025-02-23	United Kingdom	Other
No additional victim description available. ID 17717
Ransomware	Medical File id17680 View details	2025-02-20	Mexico	Healthcare / Pharma
El expediente clínico más innovador del mercado ID 17680
Ransomware	DR.Claims FL LLC id17639 View details	2025-02-19	United States	Services
No additional victim description available. ID 17639
Ransomware	EzyLegal id17638 View details	2025-02-19	India	Finance / Legal / Insurance
No additional victim description available. ID 17638
Ransomware	BeniPlus id17626 View details	2025-02-19	Canada	Other
No additional victim description available. ID 17626
Ransomware	Brolly id17625 View details	2025-02-19	United Kingdom	Other
No additional victim description available. ID 17625
Ransomware	Revi id17624 View details	2025-02-19		Other
No additional victim description available. ID 17624
Ransomware	Help Me Grow Yolo id17623 View details	2025-02-19	United States	Other
No additional victim description available. ID 17623
Ransomware	NimuSoft id17622 View details	2025-02-19	Finland	Other
No additional victim description available. ID 17622
Ransomware	Obex Medical id17501 View details	2025-02-12	New Zealand	Healthcare / Pharma
No additional victim description available. ID 17501
Ransomware	Logix Corporate Solutions id17422 View details	2025-02-11	India	Services
No additional victim description available. ID 17422
Ransomware	TMC id17420 View details	2025-02-11	Mexico	Other
No additional victim description available. ID 17420
Ransomware	Enfin id17362 View details	2025-02-10		Other
No additional victim description available. ID 17362
Ransomware	Capital Cell Global (CCG) id17346 View details	2025-02-10		Services
No additional victim description available. ID 17346
Ransomware	ASRAM Medical College and Hospita id17345 View details	2025-02-10	India	Healthcare / Pharma
No additional victim description available. ID 17345
Ransomware	Albright Institute id17293 View details	2025-02-10	Australia	Education
No additional victim description available. ID 17293
Ransomware	WhoHire id17292 View details	2025-02-10	United States	Other
No additional victim description available. ID 17292
Ransomware	Ponte16 Hotel & Casino id17133 View details	2025-02-03	Macao	Hospitality / Food & Beverage / Tourism
No additional victim description available. ID 17133
Ransomware	Nano Health id17098 View details	2025-02-01	India	Healthcare / Pharma
No additional victim description available. ID 17098
Ransomware	payahmedabadechallan.org id17006 View details	2025-01-30		Other
No additional victim description available. ID 17006
Ransomware	Let’s Secure Insurance id16867 View details	2025-01-26	India	Finance / Legal / Insurance
No additional victim description available. ID 16867
Ransomware	DataSociete id16863 View details	2025-01-25	France	Finance / Legal / Insurance
DataSociete is a comprehensive B2B platform specializing in global business intelligence and financial analysis. The company provides access to a vast database of over 12.8 million companies, offering tools for advanced searches, financial data analysis, and corporate document retrieval. ID 16863
Ransomware	Keepz id16856 View details	2025-01-25	United States	Communication / Marketing
Keepz is a cutting-edge digital payment solution provider based in Tbilisi, Georgia, offering innovative tools for businesses to streamline transactions. The company’s flagship product is its QR-based payment system, which enables businesses to accept payments without physical terminals or user registration. ID 16856
Ransomware	PrimoTicketing id16853 View details	2025-01-24	United States	Communication / Marketing
Primo Ticketing is a leading provider of digital ticketing solutions tailored for youth sports, cheer, and dance events. The company specializes in offering a seamless, all-in-one platform that simplifies ticket sales, purchases, and tracking for event organizers. Primo Ticketing’s key offerings include customizable ticket purchase links, real-time sales tracking, and dedicated equipment for on-site payment processing and ticket scanning. ID 16853
Ransomware	FAAB Invest Advisors Private Limited id16736 View details	2025-01-21	India	Communication / Marketing
No additional victim description available. ID 16736
Ransomware	Nimbus Facility Services id16735 View details	2025-01-21	United States	Services
No additional victim description available. ID 16735
Ransomware	Farmacia Cofar id16686 View details	2025-01-16	Chile	Agriculture / Food
No additional victim description available. ID 16686
Ransomware	anupalanonline.com id16685 View details	2025-01-16	India	Other
No additional victim description available. ID 16685
Ransomware	Blome International id16265 View details	2024-12-21	Germany	Services
No additional victim description available. ID 16265
Ransomware	BRIGHT BOLT ENTERPRISES INC id16264 View details	2024-12-21	Canada	Communication / Marketing
No additional victim description available. ID 16264
Ransomware	Casa Juarez Restaurant Supply Co id16263 View details	2024-12-21	United States	Hospitality / Food & Beverage / Tourism
No additional victim description available. ID 16263
Ransomware	Davis Products Company Inc id16262 View details	2024-12-21	United States	Communication / Marketing
No additional victim description available. ID 16262
Ransomware	Economy Restaurant Equipment And Supply Company id16261 View details	2024-12-21	United States	Hospitality / Food & Beverage / Tourism
No additional victim description available. ID 16261
Ransomware	GAMKA SALES CO. INC id16260 View details	2024-12-21	United States	Retail / E-commerce
No additional victim description available. ID 16260
Ransomware	Greater Michigan Distributors id16259 View details	2024-12-21	United States	Other
No additional victim description available. ID 16259
Ransomware	GPM Lawn Sprinkler Supply id16258 View details	2024-12-21	United States	Finance / Legal / Insurance
No additional victim description available. ID 16258
Ransomware	Greene Supply Company id16257 View details	2024-12-21	United States	Services
No additional victim description available. ID 16257
Ransomware	Hammons Supply Company id16256 View details	2024-12-21	United States	Services
No additional victim description available. ID 16256
Ransomware	J AND S Electrical And Lighting Supply LLC id16255 View details	2024-12-21	United States	Services
No additional victim description available. ID 16255
Ransomware	LAMERS ENTERPRISE INC id16254 View details	2024-12-21	United States	Communication / Marketing
No additional victim description available. ID 16254
Ransomware	Langford Tool And Drill Co id16253 View details	2024-12-21	United States	Other
No additional victim description available. ID 16253
Ransomware	McCally Tool and Supply id16252 View details	2024-12-21	United States	Other
No additional victim description available. ID 16252
Ransomware	Abrasive Supply Corporation id16250 View details	2024-12-21	United States	Services
No additional victim description available. ID 16250
Ransomware	Albert Paper Company id16249 View details	2024-12-21	Canada	Services
No additional victim description available. ID 16249
Ransomware	Allied Packing And Rubber Inc id16248 View details	2024-12-21	United States	Services
No additional victim description available. ID 16248
Ransomware	Avana Electrotek id16247 View details	2024-12-21	India	Other
No additional victim description available. ID 16247
Ransomware	Badger Popcorn And Concession Supply Company id16246 View details	2024-12-21	United States	Services
No additional victim description available. ID 16246
Ransomware	Accolent ERP Software id16235 View details	2024-12-20	United States	IT
No additional victim description available. ID 16235
Ransomware	PT Pertamina id16225 View details	2024-12-20	Indonesia	Other
No additional victim description available. ID 16225
Ransomware	Khalil Center id16222 View details	2024-12-20	United States	Other
No additional victim description available. ID 16222
Ransomware	Water Utilities Corporation id16221 View details	2024-12-20	Botswana	Energy
No additional victim description available. ID 16221
Ransomware	Verosa LLC id16185 View details	2024-12-18	United States	Services
No additional victim description available. ID 16185
Ransomware	JSSR Options Co., Ltd. (JSSR) id16094 View details	2024-12-15	Thailand	Services
No additional victim description available. ID 16094
Ransomware	Tumeny Payments Limited id16093 View details	2024-12-15	United Kingdom	Other
No additional victim description available. ID 16093
Ransomware	Interforos Casting id15993 View details	2024-12-11	Mexico	Other
No additional victim description available. ID 15993
Ransomware	USA2ME id15868 View details	2024-12-05	United States	Other
No additional victim description available. ID 15868
Ransomware	briatek.com.ng id15706 View details	2024-11-28	Nigeria	Other
No additional victim description available. ID 15706
Ransomware	clubfitsoftware.com.au id15705 View details	2024-11-28	Australia	IT
No additional victim description available. ID 15705
Ransomware	cloudofgoods.com id15699 View details	2024-11-28	United States	IT
No additional victim description available. ID 15699
Ransomware	gehnaindia.com id15698 View details	2024-11-28	India	Other
No additional victim description available. ID 15698
Ransomware	gajicermat.com id15697 View details	2024-11-28	India	Other
No additional victim description available. ID 15697
Ransomware	waltersgardens.com id15647 View details	2024-11-26	United States	Other
No additional victim description available. ID 15647
Ransomware	goformz.com id15643 View details	2024-11-26	United States	Other
No additional victim description available. ID 15643
Ransomware	empowersettlementservices.com id15642 View details	2024-11-26	United States	Energy
No additional victim description available. ID 15642
Ransomware	mydelux.com.my id15641 View details	2024-11-26	Malaysia	Other
No additional victim description available. ID 15641
Ransomware	Ithbar id15611 View details	2024-11-25	Saudi Arabia	Hospitality / Food & Beverage / Tourism
Choose ithbar.com as your solution to start your own crowdfunding platform. Start your own Real estate, Equity crowdfunding platform. ID 15611
Ransomware	Dardoc id15610 View details	2024-11-25	United Arab Emirates	Healthcare / Pharma
Experience doorstep home healthcare services and home nursing services in UAE with DarDoc, the front-runner in home health medical centres. ID 15610
Ransomware	inv[...]nator id15609 View details	2024-11-25	United States	Finance / Legal / Insurance
The Investment Dominator is a real estate investment CRM that allows you manage your contacts, property records, marketing campaigns and deal flow process for both land and house investing. ID 15609

Killsec

Overview

Top Countries

Known Leak Locations (3)

Top Activity Sectors (16)

Typical Attacks (12)

Victims (293)

Restricted Access

Now you can see the leak, not just the listing