Is KillSec3 Trying to Extort Victims Using Publicly Leaked Data?

This report examines KillSec’s recent ransomware activity and finds that in October–November 2024, 39 of 68 listed victims had the same or nearly identical data already publicly exposed via misconfigured storage, suggesting affiliates may be extorting organizations using previously leaked datasets rather than encrypting systems. Some RansomHub cases show a similar, though smaller, pattern. The authors found little evidence of actual encryption by KillSec in this period and advise potential victims to search for and lock down exposed servers and to avoid paying for data deletion since the information is likely already widely accessible.