CTI · reviewed · 2026-10-01

KillSec ransomware group disrupted in international law enforcement operation

Full story & timeline

Actors

KillSec

Malware / tools

KillSec ransomware

Campaigns

—

CVEs

CVE-2025-31161

Victim sectors

healthcaretechnology

Geography

IndiaUnited StatesBrazil

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1530 Data from Cloud Storage Collection
T1486 Data Encrypted for Impact Impact
T1490 Inhibit System Recovery Impact
T1567 Exfiltration Over Web Service Exfiltration
T1090 Proxy Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: KillSec Ransomware Tor C2 Egress
id: 07a4d54e-f5c4-4159-a1f3-445d07c76a96
status: experimental
description: >
    Detects network connections to Tor C2 endpoints associated with the
    KillSec ransomware-as-a-service operation, disrupted by international
    law enforcement on 30 September 2026. The IPs were published as
    command-and-control and exfiltration destinations alongside GoFile
    staging used before encryption (Europol, Halcyon, Resecurity).
references:
    - https://www.europol.europa.eu/media-press/newsroom/news/teenager-suspected-of-leading-killsec-ransomware-group-law-enforcement-seizes-servers-and-leak-site
    - https://www.halcyon.ai/threat-group/killsec
author: Tia N. List
date: 2026/10/01
tags:
    - attack.t1090
    - attack.t1567
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationIp:
            - 82.147.84.98
            - 77.91.77.187
            - 93.123.39.65
    condition: selection_c2
falsepositives:
    - Unrelated Tor traffic if these IPs are reused as public relays
    - Security research and scanning infrastructure hosted on the same providers
level: medium

References

Source on GitHub