ZeroHour

killsec3

ransomware group · aka KillSec, KillSec3, KillSec 3 · unknown · active since Mid-2023 (per public ransomware leak-site trackers)

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
3
All-time (tracked)
391since 2024-10-28
Last post
07-23 16:51UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

KillSec (tracked here under the leak-site designation 'killsec3') is an opportunistic ransomware and data-extortion operation first observed by ransomware trackers in mid-2023; any relationship to a similarly named hacktivist collective is unconfirmed. The group publishes victims and stolen data on a Tor leak site with publication countdowns, consistent with a double-extortion model, but in-depth vendor research into its malware payload, affiliate structure, and ransom demands is limited. Its listings show broad, opportunistic targeting of predominantly small and mid-sized organizations across healthcare, veterinary, legal, insurance, manufacturing, and consumer services in the United States, Latin America, India, and Israel. This dashboard's tracking shows low recent volume — 3 victims in the past 90 days and 3 total since 2026-07-23 — in line with the group's generally low posting cadence. No specific CVEs are publicly associated with its tradecraft, and no public earnings estimates are available.

Tactics & tooling
  • Publishes victim announcements and stolen data on a Tor leak site with countdown timers to publication
  • Claims double extortion (data theft plus encryption); public detail on the encryption payload used is limited
  • Targets small and mid-sized organizations more than large enterprises, based on listed victims
  • Opportunistic, multi-region targeting with no clear geographic pattern (US, Mexico, Brazil, India, Israel observed)
  • Multi-sector targeting: healthcare, veterinary, legal, insurance, manufacturing, consumer services
  • Initial access vectors not publicly documented; no widely reported exploitation of specific CVEs
  • Uses leak-site publication deadlines as the primary extortion lever in posted cases
Targeted sectors
HealthcareVeterinary servicesLegal servicesInsuranceManufacturingPest control / consumer servicesPayments / financial services
Notable public victims

Palram (palram.com) — Israeli manufacturer of polycarbonate/PVC building products, Bulwark Exterminating — US pest-control provider, Origins IVF — fertility clinic, DSD Law Firm (dsdlawfirm.com), CS Insurance (csinsurance.mx) — Mexico-based insurance firm, ACE Hospital (acehospital.in) — India-based hospital, Hospital Veterinário Diadema 24h (hospitalvetdiadema24h.com.br) — 24-hour veterinary hospital, Brazil

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
XChief / ForexChief · Oct 10, 2025xChief is a regulated online brokerage firm specializing in CFD trading on platforms such as MetaTrader 4 and MetaTrader 5. They cater to a diverse clientele, including over 1,000,000 traders worldwide, by offering a variety of financial instruments, including commodities, indices, and stock CFDs. In addition to trading, xChief provides PAMM accounts, bonuses, an affiliate program, and educational resources to help clients make informed trading decisions. The company is dedicated to ensuring safety and providing excellent customer support while facilitating easy access to financial trading.
•••yc•• •o••• C••••o · Oct 10, 2025••• Bi••••e •••e• ••m•••••;•••• ••••n• •• • •••l••••v••• g••••g ••• h••••t••••y •••u• •••a••• i• ••e ••• A••••e• ••e•• •e••••• •••• ••••l ••• •••••i•• •d••• c••••m••• •e••••g •••e••••n••••• ••••x••••n• ••d ••••a•• •m••••i••• •h• ••g••••a•••• •••••t•• • ••••n• ••t• • •i•• •r••• o• ••m••• •p••••s •••l••••g ••••e •••e•• •l•••• t••••a••••s• ••d ••••r••••v• ••c••••s• •••p••••n•••• ••• g••••• ••••r••••, •• pr••••e• ••d•••• •••••s ••• ••••e••• e•••• a•• •e••••g •••i•••••s• ••n••• o••••n• •••c••••n• ••l••••e ••••a••••t• ••d ••••)• ••d •••e •••c•••• a•• •v••••.••••T•• ••t••••i•••• ••••e ••••o••••o• ••m•• •ro• ••m••••n• •• •••••s••• g••••g •••e•••••e •••h •••h••••l••• •o••• a••••m••••i••• •n• ••v••••f••• en••••a••••n•• •l• •••e• ••e •••f• •• •••••i•• •o •••i••• g•••••, •••v••••o• ••o•••• n••••l••• s••••rs• ••d •••v••••s• ••• ••••a•• •i••••e•••••e• ••s••• t••••g• ••• ••••g••••d •••n•••••, •••a••• p••••ti•••• ••• v•••• •••••n••••e•
Vanan Online Services · Oct 10, 2025Vanan Online Services offers a comprehensive range of language services, including transcription, translation, captioning, subtitling, voice-over, and typing. They cater to individuals and businesses across various industries, providing solutions in over 100 languages with a focus on quality and affordability. With a commitment to seamless project management and customer support, they ensure timely deliveries and customer satisfaction. The company has built a strong reputation over a decade of service, making them a trusted partner in the language services field.
KillSec 4.0 ? · Oct 4, 2025?
WalletKu Indompet Indonesia walletku.com · Sep 28, 2025walletku.com
XChief / ForexChief xchief.com · Sep 28, 2025xchief.com
Study Gate studygate.com · Sep 25, 2025studygate.com
Rainwalk Technology rainwalkpetinsurance.com · Sep 22, 2025rainwalkpetinsurance.com
Fractalite fractalite.com · Sep 22, 2025fractalite.com
BEHCA behca.com · Sep 22, 2025behca.com
VTK Legal vtklegal.com · Sep 22, 2025vtklegal.com
AX CAPITAL axcapital.ae · Sep 22, 2025axcapital.ae
FDB Collections fdbcollections.com · Sep 22, 2025fdbcollections.com
MortDash mortdash.com · Sep 22, 2025mortdash.com
Scanbo scanbo.com · Sep 22, 2025scanbo.com
UwayApply uwayapply.com · Sep 22, 2025uwayapply.com
Top4Fans top4fans.com · Sep 22, 2025top4fans.com
Cadorim cadorim.com · Sep 22, 2025cadorim.com
Allure Clinics allureclinics.com · Sep 16, 2025allureclinics.com
HappyTenant happytenant.io · Sep 15, 2025happytenant.io
BlockBets Casino blockbets.casino · Sep 11, 2025blockbets.casino
Princeps Credit Systems Limited princepsfinance.com · Sep 10, 2025princepsfinance.com
BusOnlineTicket Thailand busonlineticket.co.th · Sep 10, 2025busonlineticket.co.th
1 ACT Driving Schools 1statlantaduischool.com · Sep 10, 20251statlantaduischool.com
Docklyne docklyne.com · Sep 10, 2025docklyne.com
BFLI betterfamilylife.org · Sep 10, 2025betterfamilylife.org
Accelerated Academy acceleratedacademy.us · Sep 10, 2025acceleratedacademy.us
AVA Senior Connect avaseniorconnect.com · Sep 9, 2025avaseniorconnect.com
Nathan And Nathan nathanhr.com · Sep 9, 2025nathanhr.com
Nathan nathanhr.com · Sep 7, 2025nathanhr.com
Archer Health archerhealthinc.com · Sep 7, 2025archerhealthinc.com
GPS Trackit gpstrackit.com · Sep 7, 2025gpstrackit.com
Suiza Lab suizalab.com · Sep 6, 2025suizalab.com
MedicSolution+ medicsolution.app · Sep 6, 2025medicsolution.app
eMedicoERP emedicoerp.com · Sep 6, 2025emedicoerp.com
GoTelemedicina gotelemedicina.co · Sep 6, 2025gotelemedicina.co
DUC App: Global Money Movement, Simplified ducapp.com · Aug 20, 2025ducapp.com
Doctocliq doctocliq.com · Aug 19, 2025doctocliq.com
NewGen nglogisticsllc.com · Jun 14, 2025nglogisticsllc.com
StudentKare studentkare.com · Jun 14, 2025studentkare.com
Novaria novaria.eu · May 26, 2025novaria.eu
Sama sama.bs.it · May 26, 2025sama.bs.it
Constructive Building Solutions constructivebuildingsolutions.com · May 26, 2025constructivebuildingsolutions.com
Medswana medswana.co.bw · May 20, 2025medswana.co.bw
SNS SYSTEM snssystem.com · May 6, 2025snssystem.com
Royal Saudi Air Force gov.sa · Apr 8, 2025gov.sa
Enflame Technology enflame-tech.com · Apr 7, 2025enflame-tech.com
Important Announcement crushftp.com · Apr 7, 2025crushftp.com
Royal Saudi Air Force my.gov.sa · Apr 2, 2025my.gov.sa
Collective Architecture collectivearchitecture.com · Apr 2, 2025collectivearchitecture.com

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .