THREAT ACTOR
KILLSEC_
DormantKILLSEC is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KILLSEC, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 63
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion504 Gateway Time-out snapshot · 2024-11-25 01:01
Recent victims
The 50 most recent victims claimed by KILLSEC. Total in the index: 63.
| Date listed | Victim | Description |
|---|---|---|
| 2024-10-25 | politiaromana.ro | We managed to gain access to a server belonging to the Romanian police… |
| 2024-10-23 | KillSecurity 3.0 | Click to view the new blog. |
| 2024-10-23 | shipkar.co.in | Welcome to Shipkar Express! At Shipkar Express, we are passionate abou… |
| 2024-10-22 | boloforms.com | We allow you to efficiently manage document workflows, send multi-reci… |
| 2024-10-22 | autodukan.com | AutoDukan offers a wide range of car spare parts and accessories onlin… |
| 2024-10-22 | onedayevent.com | One Day Event Insurance is a special event insurance company that sell… |
| 2024-10-20 | apollohospitals.com | Apollo Hospitals is one of India's leading healthcare institutions, of… |
| 2024-10-19 | ask.vet | AskVet provides virtual pet care services, offering 24/7 consultations… |
| 2024-10-18 | tripxoxo.com | Tripxoxo is a digital platform for travelers to book their activities,… |
| 2024-10-17 | volohealth.in | India's first fully cashless OPD solution which offers operational eff… |
| 2024-10-15 | moi.gov.ly | The Ministry of Internal Affairs of Libya (وزارة الداخلية الليبية) is … |
| 2024-10-14 | rudrakshahospitals.com | Welcome to Rudraksha Multispeciality Hospitals, the best hospital in B… |
| 2024-10-10 | extramarks.com | Trans F&B is a subsidiary of Trans Corp which is engaged in Food & Bev… |
| 2024-10-09 | transfoodbeverage.com | Trans F&B is a subsidiary of Trans Corp which is engaged in Food & Bev… |
| 2024-10-09 | argofinance.org | We are an investment company, using blockchain technology to drive sec… |
| 2024-10-09 | avans.com | Ofrecemos soluciones de acceso, control de flujo peatonal y transporta… |
| 2024-10-08 | pingan.com | Ping An is a China-based conglomerate that owns and operates businesse… |
| 2024-10-07 | healthyuturn.in | At Healthy U turn, we specialize in providing tailored dietary plans a… |
| 2024-10-06 | yassir.com | Yassir is a super app for ride-hailing, food delivery, and grocery sho… |
| 2024-10-05 | seoulpi.io | Seoul Property Insight (SPI) is a prominent player in the South Korean… |
| 2024-10-05 | betterhalf.ai | The Wedding Company is India's largest end-to-end wedding planning ser… |
| 2024-10-04 | bbgc.gov.bd | The importance of education in building a prosperous nation is immense… |
| 2024-10-01 | credihealth.com | Credihealth is a leading healthcare technology platform that provides … |
| 2024-10-01 | telehealthcenter.in | Telehealth Center allows the doctors to serve the country by serving t… |
| 2024-09-30 | itap.nacc.go.th | The Integrity and Transparency Assessment of Public Service (ITAP) is … |
| 2024-09-29 | porter.in | Porter is a tech-enabled logistics company that provides a comprehensi… |
| 2024-09-29 | poorvika.com | Poorvika Mobiles Private Ltd is a company that operates in the Consume… |
| 2024-09-29 | nfe.fazenda.gov.br | The NF-e Portal aims to provide information about the Electronic Invoi… |
| 2024-09-27 | infina.vn | Infina is a trusted investment and savings application used by over 1,… |
| 2024-09-23 | medicheck.io | MediCheck is a pioneering service provider specializing in medical con… |
| 2024-09-17 | miit.gov.cn | The Ministry of Industry and Information Technology (MIIT) is the sixt… |
| 2024-09-16 | SuperCommerce.ai | Supercommerce.ai transforms commerce in the Middle East and Africa wit… |
| 2024-09-10 | rupicard.com | India�s #1 Fixed Deposit (FD) Credit Card is empowering millions of In… |
| 2024-09-09 | schynsassurances.be | Schyns Assurances & Finances is a trusted ally in protecting your asse… |
| 2024-09-09 | pv.be | P&V is a Belgian cooperative insurance group based in Belgium. We have… |
| 2024-09-05 | cda.be | CDA Assurances is a long-established insurance company based in Belgiu… |
| 2024-09-05 | belfius.be | Belfius Bank, founded in 1996 and headquartered in Brussels, Belgium, … |
| 2024-09-05 | dvv.be | DVV Verzekeringen is a prominent insurance provider based in Belgium, … |
| 2024-08-28 | tjs.com | ZeroShrink by TJS delivers an innovative and comprehensive RFID packa… |
| 2024-08-28 | agra-services.be | Agra Services is a prominent insurance provider in Belgium, dedicated … |
| 2024-08-28 | medisetter.com | Medisetter is Vietnam's largest multichannel digital network dedicated… |
| 2024-08-27 | mykukun.com | Kukun helps homeowners buy better and renovate smarter. It offers a su… |
| 2024-08-26 | onedayonly.co.za | OneDayOnly is an online shopping platform offering a variety of deals … |
| 2024-08-25 | autonomous.ai | Autonomous specializes in ergonomic office furniture and tools aimed a… |
| 2024-08-23 | terralogs.com.br | TerraLogs is a digital platform specializing in financing solutions fo… |
| 2024-08-22 | schoolrush.com | School Rush platform allows schools to publish personalized calendar o… |
| 2024-08-22 | instadriver.co | Instadriver is a dedicated platform to find and hire drivers. Employer… |
| 2024-08-22 | level.game | Level SuperMind is a wellness technology company focused on improving … |
| 2024-08-20 | jpoint.in | Nahar JPoint, an innovative digital project launched by JITO (Jain Int… |
| 2024-08-14 | startaxi.com | Star Taxi was designed as a revolutionary solution for the Romanian ta… |
CONFIRMED ATTACKS
KillSec confirmed attacks: 13 verified incidents
Ransomnews has verified 13 KillSec incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2024 to September 2025. United States accounts for 4 of them (31%), with victims recorded in 8 countries in total. The most affected sector is healthcare, at 5 confirmed victims. Where a figure was disclosed (5 cases), these incidents account for 297,795 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified KillSec incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2025 | Archer Health, Inc. | Healthcare | California, United States | 4,285 | Unknown | Source |
| September 2025 | MedicSolution | Healthcare | Palotina, Brazil | — | Unknown | Source |
| April 2025 | KYOCERA Document Solutions Europe Management B.V. | Technology | Schiphol-Rijk, Netherlands | — | Unknown | Source |
| April 2025 | Ocuco Limited | Healthcare | Dublin, Ireland | 240,961 | Unknown | Source |
| March 2025 | Coalesce, LLC dba Benefitelect | Technology | Illinois, United States | 1,396 | Unknown | Source |
| March 2025 | Harcourts Prime Properties | Service | California, United States | — | Unknown | Source |
| December 2024 | Khalil Foundation (DBA Khalil Center) | Healthcare | Illinois, United States | 1,153 | Unknown | Source |
| December 2024 | Clubfit Software | Technology | Brisbane, Australia | — | Unknown | Source |
| September 2024 | MediCheck | Healthcare | Brussels, Belgium | 50,000 | Unknown | Source |
| September 2024 | Penbox | Technology | Brussels, Belgium | — | Unknown | Source |
| September 2024 | betterhalf.ai | Service | Bengaluru, India | — | Unknown | Source |
| August 2024 | OneDayOnly | Retail | Woodstock, South Africa | — | Unknown | Source |
| April 2024 | Delhi Police | Government | Delhi, India | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from KillSec's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.