ransomware

KillSec

active · last signal 6mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

KillSec3Kill SecurityKillSecurity

Attribution

Financially motivated cybercriminal collective; no confirmed nation-state or named-individual attribution. Analysts assess operators likely based in the Eastern Europe / Russia region based on language and communications, but this is a low-confidence inference, not confirmed.

First seen

2023-10

Last active

2026-08

Motivation

Financial gain via ransomware extortion and data-leak extortion; residual hacktivist/notoriety motivation carried over from its Anonymous-aligned origins.

Attribution confidence

medium

MENA targeting

Saudi Arabia, UAE, Egypt

Sectors

Government/defense, financial services, healthcare, retail

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia, UAE, Egypt (Government/defense, financial services, healthcare sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

SpacebearsactorTechnique overlap
IncRansomactorTechnique overlap
SinobiactorTechnique overlap
BianLianactorTechnique overlap
CactusactorTechnique overlap
OrovaactorTechnique overlap
SarcomaactorTechnique overlap
GhostSec / GhostLockeractorTechnique overlap
BrainCipher

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against KillSec's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

9 / 13

Mean robustness (of covered)

2.2

Claimed victims · 2 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

ONDJFMAMJJAS

Date	Victim	Country	Sector

Useful?