ZeroHour

killsec3

ransomware group · aka KillSec, KillSec3, KillSec 3 · unknown · active since Mid-2023 (per public ransomware leak-site trackers)

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
3
All-time (tracked)
391since 2024-10-28
Last post
07-23 16:51UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

KillSec (tracked here under the leak-site designation 'killsec3') is an opportunistic ransomware and data-extortion operation first observed by ransomware trackers in mid-2023; any relationship to a similarly named hacktivist collective is unconfirmed. The group publishes victims and stolen data on a Tor leak site with publication countdowns, consistent with a double-extortion model, but in-depth vendor research into its malware payload, affiliate structure, and ransom demands is limited. Its listings show broad, opportunistic targeting of predominantly small and mid-sized organizations across healthcare, veterinary, legal, insurance, manufacturing, and consumer services in the United States, Latin America, India, and Israel. This dashboard's tracking shows low recent volume — 3 victims in the past 90 days and 3 total since 2026-07-23 — in line with the group's generally low posting cadence. No specific CVEs are publicly associated with its tradecraft, and no public earnings estimates are available.

Tactics & tooling
  • Publishes victim announcements and stolen data on a Tor leak site with countdown timers to publication
  • Claims double extortion (data theft plus encryption); public detail on the encryption payload used is limited
  • Targets small and mid-sized organizations more than large enterprises, based on listed victims
  • Opportunistic, multi-region targeting with no clear geographic pattern (US, Mexico, Brazil, India, Israel observed)
  • Multi-sector targeting: healthcare, veterinary, legal, insurance, manufacturing, consumer services
  • Initial access vectors not publicly documented; no widely reported exploitation of specific CVEs
  • Uses leak-site publication deadlines as the primary extortion lever in posted cases
Targeted sectors
HealthcareVeterinary servicesLegal servicesInsuranceManufacturingPest control / consumer servicesPayments / financial services
Notable public victims

Palram (palram.com) — Israeli manufacturer of polycarbonate/PVC building products, Bulwark Exterminating — US pest-control provider, Origins IVF — fertility clinic, DSD Law Firm (dsdlawfirm.com), CS Insurance (csinsurance.mx) — Mexico-based insurance firm, ACE Hospital (acehospital.in) — India-based hospital, Hospital Veterinário Diadema 24h (hospitalvetdiadema24h.com.br) — 24-hour veterinary hospital, Brazil

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
Government of the People's Republic of Bangladesh GovernmentofthePeople'sRepublicofBa · Nov 26, 2024GovernmentofthePeople'sRepublicofBangladesh
waltersgardens.com waltersgardens.com · Nov 26, 2024waltersgardens.com
goformz.com goformz.com · Nov 26, 2024goformz.com
empowersettlementservices.com empowersettlementservices.com · Nov 26, 2024empowersettlementservices.com
mydelux.com.my mydelux.com.my · Nov 26, 2024mydelux.com.my
Ithbar ithbar.com · Nov 25, 2024ithbar.com
Dardoc dardoc.com · Nov 25, 2024dardoc.com
inv[...]nator investmentdominator.com · Nov 25, 2024investmentdominator.com
RiverRestHome RiverValleyRestHome.com · Nov 25, 2024RiverValleyRestHome.com
Efi Sales efisales.co.ke · Nov 24, 2024efisales.co.ke
Eassy Life eassyserve.com · Nov 24, 2024eassyserve.com
Nationwide Legal nationwidelegal.com · Nov 24, 2024nationwidelegal.com
Vogue Homes vogue-homes.com.au · Nov 23, 2024vogue-homes.com.au
ABC Group abcgroupoman.com · Nov 22, 2024abcgroupoman.com
ViralPitch viralpitch.co · Nov 21, 2024viralpitch.co
LiquiTech liquitech.co · Nov 20, 2024liquitech.co
Camim camim.com.br · Nov 20, 2024camim.com.br
Equentis Wealth equentis.com · Nov 19, 2024equentis.com
Terra Energy terraenergy.io · Nov 19, 2024terraenergy.io
Followup CRM followupcrm.com · Nov 18, 2024followupcrm.com
Buddy Loan buddyloan.com · Nov 17, 2024buddyloan.com
Dragon Capital dragoncapital.com.vn · Nov 17, 2024dragoncapital.com.vn
BluMed Health blupack.com · Nov 15, 2024blupack.com
Axpr Valve Science axpr.com.br · Nov 13, 2024axpr.com.br
Giggle Finance gigglefinance.com · Nov 12, 2024gigglefinance.com
National Institute of Administration ina.gov.ro · Nov 11, 2024ina.gov.ro
OxyHealth oxyhealth.com.sa · Nov 10, 2024oxyhealth.com.sa
BluPack.com BluPack.com · Nov 9, 2024BluPack.com
Doctor 24x7 doctor24x7.com · Nov 4, 2024doctor24x7.com
Sumitomo  srigroup.co.za · Nov 2, 2024srigroup.co.za
Doctor24x7  doctor24x7.in · Oct 28, 2024doctor24x7.in
Delcaper  delcaper.com · Oct 28, 2024delcaper.com
Government of Brazil  gov.br · Oct 28, 2024gov.br
NoBroker  nobroker.in · Oct 28, 2024nobroker.in
SW Reclaim  swreclaim.co.uk · Oct 28, 2024swreclaim.co.uk
Wilson Tarquin  wilsontarquin.co.uk · Oct 28, 2024wilsontarquin.co.uk
Bliss Worldwide  blissworldwide.in · Oct 28, 2024blissworldwide.in
Edmov  edmov.com · Oct 28, 2024edmov.com
Mixfame  mixfame.com · Oct 28, 2024mixfame.com
ConCash  concash.com.br · Oct 28, 2024concash.com.br
Fortis  fortishealthcare.com · Oct 28, 2024fortishealthcare.com

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .