KillSec originated as a hacktivist group aligned with the Anonymous movement before pivoting to ransomware operations in October 2023, officially launching a RaaS platform in June 2024 with an affiliate-friendly 88% revenue split, primarily targeting healthcare, financial services, and government sectors with over 250 documented victims as of late 2025. Known victims: 277
Objectives
Executive Summary
KillSec, originating from a hacktivist group linked with Anonymous, has transitioned into a sophisticated ransomware operation. Launching their Ransomware-as-a-Service (RaaS) platform in June 2024, they primarily target healthcare, financial, and government sectors. With over 250 documented victims by late 2025, KillSec poses a significant threat to these industries with their affiliate-friendly revenue model.
Goals & Targeting
KillSec's strategic objectives center on generating substantial financial returns through ransomware campaigns. Targeting sectors with high recovery costs and potential for quick payouts, such as healthcare and financial services, aligns with their goal of maximizing profit. Their selection of victims reflects a calculated approach to exploit critical infrastructure while avoiding prolonged operational exposure.
Enhanced Description
KillSec emerged from hacktivist roots within the Anonymous movement before shifting focus to ransomware in October 2023. By June 2024, they had established a RaaS platform offering an attractive 88% revenue split for affiliates, facilitating rapid growth and widespread campaigns across multiple sectors. Primarily targeting healthcare, financial services, and government entities, KillSec has demonstrated both technical proficiency and strategic focus in their operations. Their activities highlight a clear shift from hacktivism to criminal enterprise driven by financial gain.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
KillSec's affiliate program has significantly amplified their operational reach, enabling a high volume of attacks across various industries. Campaigns often involve large-scale data encryption and demands for substantial ransoms. Notable victims include healthcare providers such as MedicalGPT and MyFair, demonstrating their focus on sectors with critical data vulnerabilities. KillSec's campaigns have shown adaptability in delivery methods but remain less sophisticated than state-sponsored actors.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
High confidence in KillSec's operational patterns and goals, supported by their extensive victim list and RaaS activities. Limited visibility into specific technical tools or infrastructure complicates detailed analysis, suggesting areas for further investigation.
No techniques linked yet.
No tools linked yet.
killsec: origins ivf
Ransomware attack attributed to killsec. | Country: IN | Sector: Healthcare | Price ??? Disclosures 0/1 | Source: https://www.ransomware.live/id/b3JpZ2lucyBpdmZAa2lsbHNlYw==
Jul 23, 2026
TLP:CLEARNo observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
16
Campaigns
0
IOCs
0
Observed Data
0
Tactics