Threat Intelligence Tarot
Vol. II · 143
Hacktivist + Criminal (mixed)
★★★★★
risk 3/5
✦ The Painted Wall ✦
KillSec
KillSec3 · Kill Security
Indian government portalsTelecommunicationsSmall businessesPublic services
Active since ~2023 · Notoriety, Anti-India and anti-government messaging, Financial gain via RaaS pivot
The Painted Wall starts as graffiti and ends as a ransom note. Ideology is the entry pose; recurring revenue is the strategy. The slogans on the leak site stay the same; the prices update weekly.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Indian government portal defacement campaigns
- ◆Telecom intrusion claims against South Asian operators
- ◆Transition to ransomware-as-a-service operations (late 2024)
- ◆KillSec affiliate program advertising on dark-web forums
Defenses
- ▸Government portal CDN protection and rate limitingOWASP ASVS
- ▸Continuous CVE patching for public-facing applicationsCISA KEV Catalog
- ▸RaaS affiliate program monitoring on dark-web forumsNIST CSF: ID.RA ↗
- ▸Immutable backups tested against ransomware playbooksCIS Control 11 ↗
Reversed: Their Weakness
Hacktivist-to-RaaS conversions are detectable in messaging tone shifts and infrastructure overlap with established criminal hosters. Threat intelligence teams that track tone, not just IOCs, often see the pivot first.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.