Loading malware…
KillSec is a ransomware operation that emerged from an Anonymous-aligned hacktivist background and later evolved into a financially motivated ransomware and ransomware-as-a-service actor. By 2025 it had gained traction as an active extortion threat and was repeatedly observed among ransomware strains affecting healthcare-related organizations. Victim reporting also linked the operation to attacks outside healthcare, including organizations in South Korea and Brazil, indicating opportunistic multi-sector targeting rather than a narrowly specialized victim profile.
KillSec is associated with ransomware-based extortion and has been characterized as a hybrid actor blending hacktivist origins with profit-driven criminal activity. Reporting also indicates that it offered affiliates additional offensive tooling, including distributed denial-of-service and data-stealing capabilities, consistent with broader multi-extortion tradecraft in the ransomware ecosystem. Its activity has been discussed alongside other prominent 2025 ransomware groups, reflecting its rise within a fragmented threat landscape shaped by affiliate migration and the proliferation of smaller brands.
High-confidence reporting supports classifying KillSec as ransomware targeting enterprise environments, but the available information here does not establish a specific initial access vector, operating system focus, or distinctive technical implementation with sufficient certainty. Its known impact is most clearly tied to extortion operations against organizations, including healthcare businesses.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An emerging ransomware strain that surfaced or gained traction during 2025.
Ransomware used in attacks against organizations in South Korea (exhibition management platform and an elevator manufacturer).
A ransomware group noted for targeting healthcare providers in Q3 2025.
Ransomware strain reported among the most common targeting healthcare businesses in 2025; associated with significant record exposure in at least one cited incident.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.