02-Oct-2026 KillSec Takedown, Warlock Ransomware and DragonForce MQTT Attacks

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and business decision-makers. Today’s briefing covers five developments: 1. Authorities seized KillSec’s leak infrastructure and arrested three alleged members, including its suspected 16-year-old leader, in an operation coordinated with Europol and U.S. officials. The group allegedly targeted about 500 organizations, and the takedown could disrupt its extortion activity while exposing further members and victims. 2. A security verification page temporarily blocked access until JavaScript and cookies were enabled. The incident reflects the growing use of bot protection to counter malicious traffic and scraping, while highlighting the need to balance security controls with user experience and operational visibility. 3. The Warlock ransomware campaign is targeting Spanish- and Portuguese-speaking organizations, expanding its reach and increasing pressure on international businesses. Its localized extortion tactics show how ransomware groups are adapting attacks to maximize disruption and payment demands. 4. No article text was provided beyond a verification page, so there is no additional story to summarize. 5. Researchers linked DragonForce activity to the abuse of MQTT for covert communications and backdoor deployment. The tactic demonstrates how attackers can repurpose legitimate protocols to evade traditional monitoring, maintain persistence, and delay detection. Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.