Group IB Supports Joint Investigation Into KillSec Ransomware Gang
TECHWORLD ·
✦ AI Summary
Group-IB said on the 21st that it had joined efforts to support the investigation into the RaaS group KillSec (KillSec).
The international investigation was led by the Landeskriminalamt Hamburg and the Hamburg Public Prosecutor's Office, with Europol and Eurojust providing support.
Group-IB said it provided Cyber Threat Intelligence on KillSec's operating methods, infrastructure and Key Enablers, while continuously monitoring its Leak Site and Telegram channel.
Group-IB said on the 21st that it had joined efforts to support the investigation into the RaaS group KillSec. The international investigation was led by the Landeskriminalamt Hamburg and the Hamburg Public Prosecutor's Office, with Europol and Eurojust taking part as supporting agencies.
The target of the investigation was KillSec, a group linked to about 1,000 suspected attacks worldwide. On September 30, 2026, law enforcement agencies took control of KillSec's Leak Site and secured at least 110 TB of stolen data in the process.
In Greece, Romania, Spain and the U.K., authorities also provisionally detained 3 suspects and searched 8 locations. During the investigation, a 16-year-old suspect believed to be a key operator was also identified.
Group-IB provided Cyber Threat Intelligence on KillSec's operating methods, infrastructure and Key Enablers in connection with the international investigation. To do so, Group-IB continuously monitored KillSec's Leak Site and Telegram channel.
As a result, Group-IB identified 274 organizations that KillSec publicly claimed as victims on its leak site. By country, organizations based in the U.S. accounted for about 35%, ranking first, followed by India at 17%. Brazil, the U.K., Australia and Colombia each accounted for about 3%.
By region, North America accounted for about 35% of the victims, followed by Asia-Pacific at 30%, Europe at 14% and the Middle East and Africa (MEA) at about 10%. By sector, financial services and health care made up most of the damage.
The list of victims also included government agencies and large companies. Examples of major victim organizations included a large insurer, an investment firm and a consumer app company with several million users.
In earlier recruitment posts, KillSec said it would exclude hospitals from its targets, but since late last year, health care software providers and IT service providers have been identified as targets. The company also presented analysis showing that there is trading activity involving stolen data after ransomware attacks.
The company's researchers analyzed the KillSec 2.0 Affiliate Platform and said it was used for victim management, ransomware negotiations and Payload configuration. In October 2024, the platform's support terms included a USD 250 entry fee for affiliate attackers and a 12% share of attack proceeds.
In addition, affiliate attackers were not allowed to generate ransomware builds whenever they wanted, and each build required approval from a KillSec administrator. The company's researchers cited this build approval system as evidence for their analysis, saying it indicated the existence of a small core operating team responsible for managing ransomware Payloads.
The main intrusion methods used by KillSec's affiliate attackers were phishing, brute-force attacks against exposed RDP systems and exploitation of known vulnerabilities in internet-facing applications. In many confirmed victim cases, network intrusion was not necessary.
In those cases, data was directly stolen from cloud storage that had been made publicly accessible due to Misconfiguration. In some cases, damage occurred using only exposed resources, without any internal intrusion.
Group-IB CEO Dmitry Volkov said the main targets of KillSec's affiliate attackers were organizations people rely on, such as hospitals, government agencies and financial institutions. He said servers can be replaced in a few weeks, but ransomware platform developers and individual attack approvers cannot be easily replaced. He added that identifying these actors and supporting judicial procedures by law enforcement agencies can turn simple infrastructure takedowns into the actual dismantling of a criminal organization.
Group-IB recommended that companies manage security risks for externally exposed assets. It said organizations should maintain Continuous Inventory for internet-facing assets and explained that this scope includes cloud storage and remote access services. It also recommended applying MFA to remote access and prioritizing patches for vulnerabilities that are being exploited in real attacks.
Group-IB also said it has worked with Europol and other law enforcement agencies on international cybercrime investigations. The company said it has contributed to more than 1,600 High-Tech Crime Investigations in more than 60 countries, and it plans to continue cooperation on cybercrime response with Europol and law enforcement partners.
Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=408548
References
This article was produced with the help of an automated content generation algorithm.
Source: TECHWORLD
View originalThis article was summarized and organized by BizCrush based on the original article from TECHWORLD. For exact quotations and full details, please refer to the original article.