24/7 ransomware incident response by senior DFIR experts. Get in touch now – we support you right away.
KillSec is a double-extortion ransomware group that steals and encrypts data before threatening to publish it on a Tor-based leak site. Since early 2024, the group has claimed hundreds of victims worldwide, with a strong focus on healthcare and technology providers.
Based on open-source tracking of KillSec’s leak portal and victim disclosures.
Ransomware is our daily work. We combine technical forensics, crisis management and practical recovery planning so you can make informed decisions under pressure.
Our DFIR team has handled complex incidents involving KillSec and other data-stealing groups across healthcare, software, manufacturing and professional services.
We understand typical playbooks, leak-site behaviour and negotiation patterns.
From first triage and containment to forensics, decryption strategy and rebuild: we support the full lifecycle of your incident – not just “fix one server”.
We work with your existing tools and teams. No product lock-in – just practical support focused on reducing downtime and risk.
We coordinate with internal IT, insurers, legal counsel and – where appropriate – law enforcement.
The first days of a KillSec ransomware incident are critical. Our structured playbook helps you stabilise operations, preserve evidence and prepare for recovery – including potential negotiations and regulatory obligations.
Hour 0–4
Rapid triage & containment
We assess the scope and impact, guide you through safe isolation of affected systems, and stop further lateral movement – without destroying critical artefacts.
Hour 4–24
Forensic acquisition & attacker analysis
We collect system images, logs and volatile data, then identify KillSec’s tooling, persistence mechanisms and paths used for data theft and encryption.
Day 2–3
Recovery plan & decision support
We design a phased recovery plan, including options with and without payment, and provide technical input for executive, legal and communication teams (for example regulators and customers).
Many victims contact us after they have begun communicating with KillSec operators or their affiliates through the Tor chat portal.
Even if you are “late” in the incident, external experts can reduce downtime and long-term risk significantly – for example by avoiding mis-steps that trigger further data leaks.
Beyond emergency response, we help you make your network more resilient against future ransomware – from hardening identity systems and backups to monitoring and response readiness.
The following profile is based on public reporting and leak-site tracking. Indicators of compromise (IOCs) are examples only – do not rely on static indicators alone for detection.
Public trackers show more than 250 listed victims between March 2024 and December 2025, with many cases in the US, India, the UK, Brazil and Belgium.
External reports describe campaigns against Latin American healthcare and medical IT providers, where attackers abused misconfigured cloud storage, exposed web services and spear-phishing with malicious documents.
Indicators vary between campaigns and should be combined with behavioural detection. Typical elements in modern ransomware intrusions include:
vssadmin delete shadows /all /quiet
wmi shadowcopy delete
bcdedit /set {default} recoveryenabled No
These commands alone do not prove a KillSec intrusion, but they are useful starting points for threat hunting and detection.
Public information on KillSec’s tooling is still evolving. However, many observed campaigns follow patterns common to modern double-extortion groups:
T1078 – Valid Accounts (VPN / RDP without MFA), T1190 – Exploit Public-Facing Application, misconfigured cloud storageT1059 – Command and Scripting Interpreter (PowerShell, cmd)T1547 – Boot or Logon Autostart Execution (services, scheduled tasks)T1068 – Exploitation for Privilege EscalationT1562 – Impair Defenses (disabling AV/EDR, deleting logs)T1003 – OS Credential Dumping (LSASS, SAM, ntds.dit)T1087 – Account Discovery, T1018 – Remote System DiscoveryT1021 – Remote Services (RDP, SMB, WinRM)T1119 – Automated Collection, T1041 – Exfiltration Over C2 Channel / Web ServicesT1486 – Data Encrypted for Impact, T1490 – Inhibit System RecoveryNot necessarily. Recovery from clean backups or partial rebuild is sometimes possible without paying. In other cases, the business impact, data exposure, legal requirements and insurance conditions must be weighed carefully. We help you understand the technical feasibility of each option.
There is no generally available decryptor for current KillSec variants. Any “miracle tool” promising guaranteed decryption should be treated with scepticism. Our focus is on containment, forensics, recovery and long-term resilience.
Yes. We frequently work alongside cyber-insurance carriers and law firms. Our role is to provide a reliable technical picture and support risk-based decisions, including regulator and customer communication.
For active incidents we aim to bring a senior responder onto a remote triage call very quickly once you contact our hotline or send an incident email. On-site presence can be arranged depending on location and urgency.
As a specialised incident response and digital forensics team, we help organisations handle KillSec incidents in a structured, risk-based way:
On request, we provide lightweight checklists and scripts customers can use to review their own infrastructure for typical ransomware weaknesses (for example remote access, backups, identity and logging).