Kill Security (KillSec)
A ransomware-as-a-service operation that also stole data from poorly secured cloud storage. Police seized its leak site and servers on 30 September 2026 and made three provisional arrests.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
KillSec matters less now as a live brand than as a record of what worked. Group-IB says a substantial share of victims lost data from publicly accessible, misconfigured cloud storage, with no network intrusion needed.1 Infosecurity Magazine also reports that it sometimes stole and extorted data without encrypting anything.4
There is a direct UK link. The UK took part in Operation KillSwitch and one of the searches took place there. Group-IB puts the UK at about 3% of the victims it identified.1 The Register reports that UK police arrested a man Europol described to it as an alleged KillSec negotiator, and that US prosecutors, who have charged him, are seeking his extradition. These are allegations, and the report does not say the US charges concern KillSec.5
Europol's figures, as reported by Infosecurity Magazine, are at least 500 successful attacks and about twice that number overall.3,4 Group-IB identified 274 organisations publicly claimed on the leak site.1 Arrests are provisional and nobody has been convicted in the sources we reviewed.
Group-IB says some KillSec affiliates also worked with LockBit, RansomHub, Qilin and Bashe.1 We would treat the brand as disrupted, not the people or the methods, and would still fix the open cloud storage it relied on.
How It Attacks
Based on Group-IB's summary of the group's operations.1 Affiliates varied, so this is not a fixed script.
- 1
Recruit Affiliates
Ran an affiliate panel for managing victims, negotiations and payload settings, and took a share of each ransom.
- 2
Get In
Used phishing, brute force against exposed RDP and known flaws in internet-facing applications.
- 3
Or Skip the Network
Took data directly from misconfigured, publicly accessible cloud storage.
- 4
Encrypt Where Useful
Used a Windows locker and, from November 2024, a VMware ESXi locker that shuts down virtual machines, deletes snapshots and erases logs.
- 5
Extort and Sell
Named victims on a leak site and Telegram channels, and sold stolen data directly.
Key Techniques
Our mapping of the behaviour Group-IB describes.1 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1566 | Phishing | Initial Access | Reported as an entry route. |
| T1110 | Brute Force | Credential Access | Targets exposed RDP services. |
| T1190 | Exploit Public-Facing Application | Initial Access | Uses known flaws in internet-facing applications. |
| T1530 | Data from Cloud Storage | Collection | Takes data from misconfigured, public cloud storage. |
| T1490 | Inhibit System Recovery | Impact | The ESXi locker deletes snapshots. |
| T1486 | Data Encrypted for Impact | Impact | Windows and ESXi lockers. |
Key Events
Group-IB first identifies the group.1 Bitdefender dates its ransomware-as-a-service operation to late in the second quarter.2
Adds a locker for VMware ESXi.1
Shifts towards healthcare software and IT service providers, despite a January 2025 pledge to avoid hospitals.1
Police take control of the leak site and five servers. Three provisional arrests and eight searches in Greece, Romania, Spain and the UK.1
Europol publishes the results of Operation KillSwitch.6
Defences That Matter
Audit Cloud Storage
- Audit access to cloud storage, especially buckets and shares nobody owns, such as those left from ended projects, acquisitions or tests.6
- Alert on storage that becomes publicly reachable.
Patch What Faces the Internet
- Patch internet-facing software first.6
- Remove RDP from the internet and put remote access behind MFA.
Plan for ESXi Loss
- Keep backups of virtual machines outside the reach of ESXi admin accounts, because the locker deletes snapshots.
- Test recovery of hypervisors as well as servers.
Is Your Cloud Storage Really Private?
We can help you find exposed storage and internet-facing weaknesses before a criminal group does.
Sources
- Group-IB: Group-IB supports international Operation KillSwitch targeting the KillSec ransomware-as-a-service group, 1 October 2026
- Bitdefender: Threat Debrief, October 2026, 6 October 2026
- Europol: Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site, 2026
- Infosecurity Magazine: Police Target KillSec Ransomware Group with Arrests and Seizures, 2 October 2026
- The Register: Teen suspected of running KillSec ransomware group as cops seize servers, arrest three, 2 October 2026
- Bitdefender: Bitdefender Supported Operation KillSwitch: What the KillSec Takedown Changes for Defenders, October 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.