KillSec is a RaaS-based ransomware group originating from Anonymous, targeting healthcare, financial, and government sectors.
Analyst brief
KillSec originated as a hacktivist group tied to the Anonymous movement before pivoting to ransomware operations in October 2023. They primarily target the healthcare, financial services, and government sectors in the United States, India, and Mexico. The group launched a RaaS platform in June 2024 with an attractive affiliate payout structure, leveraging this model to scale their attacks. Defenders should focus on ransomware-specific TTPs, enhance threat hunting in targeted sectors, and monitor for RaaS affiliate activities.
killsec
activecrime
KillSec originated as a hacktivist group aligned with the Anonymous movement before pivoting to ransomware operations in October 2023, officially launching a RaaS platform in June 2024 with an affiliate-friendly 88% revenue split, primarily targeting healthcare, financial services, and government sectors with over 250 documented victims as of late 2025.