Back to malware

Malware

KillSec ransomware

KillSec ransomware is a ransomware threat identified in reporting as actively attacking healthcare institutions in Brazil. The provided content describes it as associated with the KillSec ransomware crew and notes a recent hacking spree targeting Brazilian healthcare organizations. High-confidence details in the source are limited to this targeting information; no specific infection vector, technical behavior, malware family lineage, or indicators of compromise are provided in the content.

Share:

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

“KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems.”

T1190Exploit Public-Facing ApplicationEvidence1

“KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems.”

Persistence

1 technique

T1078Valid AccountsEvidence1

“KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems.”

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

“KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems.”

Stealth

1 technique

T1078Valid AccountsEvidence1

“KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems.”

Collection

1 technique

T1213Data from Information RepositoriesEvidence1

“The group broke into systems by exploiting software flaws and weak security, often targeting cloud storage. After stealing sensitive data, they posted victims on their leak site...”

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

“Law enforcement seized control of KillSec’s dark web leak site, the Tor website the group used to threaten victims with publishing stolen files unless they paid up.”

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

“Operation KillSwitch: Europol says the KillSec ransomware group... was dismantled...”

T1657Financial TheftEvidence1

“In some cases, the group received ransom payments.” | “After stealing sensitive data, they posted victims on their leak site and demanded payment to keep the data private.”

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

risky biz rssNews

Risky Bulletin: US largest crypto ATM operator sued for profiting from scams

KillSec ransomware is a ransomware strain associated with a group that has recently targeted Brazilian healthcare organizations.

securityaffairsNews

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 62

Ransomware that targets healthcare institutions in Brazil, encrypting files and demanding payment for decryption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.