- Published
- Source
- Bitdefender
- Filed under
- Ransomware, Phishing & scams, Attacks
An international operation has disrupted KillSec’s servers and data leak site, with three suspects arrested. Bitdefender supported the investigation into the group, which authorities link to around 1,000 suspected cyberattacks worldwide. Key takeaways * Investigators identified a 16-year-old as KillSec’s suspected administrator and main operator * Operation KillSwitch leads to three provisional arrests and eight…
Spotted a scam?
- Forward suspicious emails to report@phishing.gov.uk – the NCSC uses the reports to take scam sites down.
- Forward scam texts to 7726, free on most UK networks.
- Never share a one-time code, and check any request for money by calling a number you already trust.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Data Encrypted for Impact
ImpactWhat a defender checks
- Isolate affected hosts from the network to stop the spread.
- Confirm backups are offline and restorable – then test a restore.
- Hunt for what came first: new admin accounts, disabled security tools, remote-access software.
Build the skillBlue Team Engineer · Incident Management & Response Engineering
Exfiltration Over Web Service
ExfiltrationWhat a defender checks
- Watch for large uploads to cloud storage and file-sharing sites.
- Hunt for tools like rclone and unexpected archive files.
- Use DLP on your most sensitive data.
Build the skillBlue Team Specialist · Breach Analysis
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst · Email & Phishing Investigation
Someone will report this email. Know exactly what to do next.
Analyse a reported phishing email properly: headers, message trace and quarantine, what SPF, DKIM and DMARC failures tell you, and the indicators that make it business email compromise.
- Header forensics and message trace
- SPF, DKIM and DMARC failures explained
- Spotting business email compromise
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
