{"id":1339,"date":"2026-10-06T09:50:27","date_gmt":"2026-10-06T07:50:27","guid":{"rendered":"https:\/\/comsource.cz\/?p=1339"},"modified":"2026-10-07T15:59:32","modified_gmt":"2026-10-07T13:59:32","slug":"threat-intelligence-killsec-operation-killswitch","status":"publish","type":"post","link":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/","title":{"rendered":"Threat Intelligence Doesn\u2019t End with an Alert: How It Helped Disrupt the KillSec Ransomware Group"},"content":{"rendered":"

Operation KillSwitch disrupted the KillSec ransomware group, linked to around 1,000 suspected attacks worldwide. Group-IB supported investigators with intelligence on the group’s infrastructure, operations and key enablers. The case demonstrates how Threat Intelligence is evolving from monitoring cyber threats to actively disrupting the ecosystems behind them.<\/strong><\/p>\n

Ransomware is no longer simply a malicious program developed and distributed by an individual attacker. Increasingly, it operates as an organised business with its own infrastructure, developers, negotiators and networks of affiliates.<\/p>\n

The recent disruption of KillSec<\/strong> provides a clear example.<\/p>\n

At the end of September, international law enforcement agencies carried out Operation KillSwitch<\/strong>, an investigation led by German authorities with support from Europol and Eurojust.<\/p>\n

The investigation covers around 1,000 suspected attacks worldwide<\/strong>, approximately 500 of which have so far been identified as successful. Authorities took control of five central servers and domains used by the group and secured at least 110 TB of stolen data<\/strong>. Three suspects were provisionally arrested and eight properties were searched across four European countries. Investigators identified a 16-year-old as the group’s suspected main operator. Europol<\/a><\/p>\n

Ransomware as a Service<\/h2>\n

KillSec operated as a Ransomware-as-a-Service (RaaS)<\/strong> group.<\/p>\n

Its core team provided infrastructure and tools to affiliates who carried out attacks and shared the proceeds.<\/p>\n

Group-IB, which supported the investigation as a private-sector cybersecurity partner, had been monitoring KillSec’s dark web leak site and communication channels. Its research identified 274 organisations publicly claimed as victims<\/strong> by the group. Financial services and healthcare were among the most affected sectors, alongside government bodies and large enterprises. Group-IB<\/a><\/p>\n

The methods used by the attackers are equally significant.<\/p>\n

Alongside phishing, brute-force attacks against exposed RDP services and exploitation of known vulnerabilities in internet-facing applications, KillSec affiliates also targeted misconfigured cloud storage<\/strong>.<\/p>\n

In some cases, no traditional network intrusion was necessary at all. Sensitive data was simply exposed because cloud resources had been incorrectly configured. Group-IB<\/a><\/p>\n

Europol also reported that KillSec used artificial intelligence to build and maintain its ransomware infrastructure and to identify potential victims<\/strong>. Europol<\/a><\/p>\n

What Threat Intelligence Can Actually Do<\/h2>\n

The KillSec case illustrates the difference between detecting an individual security incident and using Threat Intelligence<\/strong>.<\/p>\n

Security controls can block a particular attack.<\/p>\n

Threat Intelligence goes further. It can monitor attacker infrastructure, domains, underground forums and marketplaces, communication channels, tools and relationships between individual threat actors.<\/p>\n

During Operation KillSwitch, Group-IB provided investigators with intelligence on KillSec’s operations, infrastructure and key enablers<\/strong>, contributing to the international investigation that ultimately targeted both the group’s technical infrastructure and the people behind it. Group-IB<\/a><\/p>\n

This changes the way organisations should think about Threat Intelligence.<\/p>\n

The objective is not simply to know that a threat exists. It is to understand who is behind it, how they operate, what they are looking for and whether your organisation may already be on their radar.<\/strong><\/p>\n

What Can Czech Organisations Learn from KillSec?<\/h2>\n

An organisation’s greatest weakness does not always have to be a sophisticated zero-day vulnerability.<\/p>\n

Attackers often choose the path of least resistance: exposed remote access, a known vulnerability that has not yet been patched, a cloud misconfiguration or data that is more publicly accessible than its owner realises.<\/p>\n

Effective cyber defence therefore requires several layers to work together:<\/p>\n

understanding your internet-facing attack surface, continuously assessing vulnerabilities, securing identities and remote access, monitoring activity outside your own infrastructure, and identifying relevant threat actor activity before an incident appears inside the network.<\/strong><\/p>\n

That final capability is becoming increasingly important.<\/p>\n

An attack does not begin when an alert appears in the SOC.<\/p>\n

It may begin much earlier \u2013 when attackers identify a potential victim, discuss an organisation in an underground community, trade compromised credentials or map its external infrastructure.<\/p>\n

That is where Threat Intelligence begins.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Operation KillSwitch disrupted the KillSec ransomware group, linked to around 1,000 suspected attacks worldwide. Group-IB supported investigators with intelligence on the group’s infrastructure, operations and key enablers. The case demonstrates how Threat Intelligence is evolving from monitoring cyber threats to actively disrupting the ecosystems behind them. Ransomware is no longer simply a malicious program developed […]<\/p>\n","protected":false},"author":2,"featured_media":1343,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[7,23],"tags":[],"class_list":["post-1339","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","category-cybersecurity-en"],"yoast_head":"\nThreat Intelligence in Action: Disrupting KillSec | ComSource<\/title>\n<meta name=\"description\" content=\"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Threat Intelligence in Action: Disrupting KillSec | ComSource\" \/>\n<meta property=\"og:description\" content=\"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/\" \/>\n<meta property=\"og:site_name\" content=\"ComSource\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ComSource\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-06T07:50:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-07T13:59:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920-1024x683.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"683\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Dagmar Zweschperov\u00e1\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dagmar Zweschperov\u00e1\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/\",\"url\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/\",\"name\":\"Threat Intelligence in Action: Disrupting KillSec | ComSource\",\"isPartOf\":{\"@id\":\"https:\/\/comsource.cz\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png\",\"datePublished\":\"2026-10-06T07:50:27+00:00\",\"dateModified\":\"2026-10-07T13:59:32+00:00\",\"author\":{\"@id\":\"https:\/\/comsource.cz\/en\/#\/schema\/person\/8154e01b531b48967cfad01950d937e7\"},\"description\":\"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.\",\"breadcrumb\":{\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage\",\"url\":\"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png\",\"contentUrl\":\"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png\",\"width\":1920,\"height\":1280},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/comsource.cz\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Threat Intelligence Doesn\u2019t End with an Alert: How It Helped Disrupt the KillSec Ransomware Group\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/comsource.cz\/en\/#website\",\"url\":\"https:\/\/comsource.cz\/en\/\",\"name\":\"ComSource\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/comsource.cz\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\/\/comsource.cz\/#organization\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/comsource.cz\/en\/#\/schema\/person\/8154e01b531b48967cfad01950d937e7\",\"name\":\"Dagmar Zweschperov\u00e1\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/comsource.cz\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5244299ea5bcb5afc48268d25615ace7e74d6f8039a508df0d298ac674b548ed?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5244299ea5bcb5afc48268d25615ace7e74d6f8039a508df0d298ac674b548ed?s=96&d=mm&r=g\",\"caption\":\"Dagmar Zweschperov\u00e1\"},\"url\":\"https:\/\/comsource.cz\/en\/author\/dagmar-zweschperova\/\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/comsource.cz\/#organization\",\"name\":\"ComSource\",\"legalName\":\"ComSource s.r.o.\",\"url\":\"https:\/\/comsource.cz\/\",\"telephone\":\"+420226801700\",\"email\":\"info@comsource.cz\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Nad Vr\u0161ovskou horou 1423\/10\",\"addressLocality\":\"Praha 10\",\"postalCode\":\"101 00\",\"addressCountry\":\"CZ\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/comsource-s.r.o.\/\",\"https:\/\/www.facebook.com\/ComSource\",\"https:\/\/www.youtube.com\/channel\/UCR0pWsBktzx2V-kbtF8Beuw\",\"https:\/\/www.instagram.com\/comsource_czech_\/\"],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/comsource.cz\/#brand-logo\",\"url\":\"https:\/\/comsource.cz\/wp-content\/themes\/comsource\/Assets\/img\/logotype\/dark.svg\",\"contentUrl\":\"https:\/\/comsource.cz\/wp-content\/themes\/comsource\/Assets\/img\/logotype\/dark.svg\",\"caption\":\"ComSource\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Threat Intelligence in Action: Disrupting KillSec | ComSource","description":"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/","og_locale":"en_US","og_type":"article","og_title":"Threat Intelligence in Action: Disrupting KillSec | ComSource","og_description":"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.","og_url":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/","og_site_name":"ComSource","article_publisher":"https:\/\/www.facebook.com\/ComSource","article_published_time":"2026-10-06T07:50:27+00:00","article_modified_time":"2026-10-07T13:59:32+00:00","og_image":[{"width":1024,"height":683,"url":"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920-1024x683.png","type":"image\/png"}],"author":"Dagmar Zweschperov\u00e1","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Dagmar Zweschperov\u00e1","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/","url":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/","name":"Threat Intelligence in Action: Disrupting KillSec | ComSource","isPartOf":{"@id":"https:\/\/comsource.cz\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage"},"image":{"@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage"},"thumbnailUrl":"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png","datePublished":"2026-10-06T07:50:27+00:00","dateModified":"2026-10-07T13:59:32+00:00","author":{"@id":"https:\/\/comsource.cz\/en\/#\/schema\/person\/8154e01b531b48967cfad01950d937e7"},"description":"Operation KillSwitch disrupted KillSec. See how Group-IB used Threat Intelligence to uncover ransomware infrastructure and key threat actors.","breadcrumb":{"@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#primaryimage","url":"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png","contentUrl":"https:\/\/comsource.cz\/wp-content\/uploads\/2026\/10\/seagul-cybersecurity-10194200_1920.png","width":1920,"height":1280},{"@type":"BreadcrumbList","@id":"https:\/\/comsource.cz\/en\/threat-intelligence-killsec-operation-killswitch\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/comsource.cz\/en\/"},{"@type":"ListItem","position":2,"name":"Threat Intelligence Doesn\u2019t End with an Alert: How It Helped Disrupt the KillSec Ransomware Group"}]},{"@type":"WebSite","@id":"https:\/\/comsource.cz\/en\/#website","url":"https:\/\/comsource.cz\/en\/","name":"ComSource","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/comsource.cz\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US","publisher":{"@id":"https:\/\/comsource.cz\/#organization"}},{"@type":"Person","@id":"https:\/\/comsource.cz\/en\/#\/schema\/person\/8154e01b531b48967cfad01950d937e7","name":"Dagmar Zweschperov\u00e1","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/comsource.cz\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5244299ea5bcb5afc48268d25615ace7e74d6f8039a508df0d298ac674b548ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5244299ea5bcb5afc48268d25615ace7e74d6f8039a508df0d298ac674b548ed?s=96&d=mm&r=g","caption":"Dagmar Zweschperov\u00e1"},"url":"https:\/\/comsource.cz\/en\/author\/dagmar-zweschperova\/"},{"@type":"Organization","@id":"https:\/\/comsource.cz\/#organization","name":"ComSource","legalName":"ComSource s.r.o.","url":"https:\/\/comsource.cz\/","telephone":"+420226801700","email":"info@comsource.cz","address":{"@type":"PostalAddress","streetAddress":"Nad Vr\u0161ovskou horou 1423\/10","addressLocality":"Praha 10","postalCode":"101 00","addressCountry":"CZ"},"sameAs":["https:\/\/www.linkedin.com\/company\/comsource-s.r.o.\/","https:\/\/www.facebook.com\/ComSource","https:\/\/www.youtube.com\/channel\/UCR0pWsBktzx2V-kbtF8Beuw","https:\/\/www.instagram.com\/comsource_czech_\/"],"logo":{"@type":"ImageObject","@id":"https:\/\/comsource.cz\/#brand-logo","url":"https:\/\/comsource.cz\/wp-content\/themes\/comsource\/Assets\/img\/logotype\/dark.svg","contentUrl":"https:\/\/comsource.cz\/wp-content\/themes\/comsource\/Assets\/img\/logotype\/dark.svg","caption":"ComSource"}}]}},"_links":{"self":[{"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/posts\/1339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/comments?post=1339"}],"version-history":[{"count":1,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/posts\/1339\/revisions"}],"predecessor-version":[{"id":1340,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/posts\/1339\/revisions\/1340"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/media\/1343"}],"wp:attachment":[{"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/media?parent=1339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/categories?post=1339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/comsource.cz\/en\/wp-json\/wp\/v2\/tags?post=1339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}