Police shut down KillSec ransomware ring, name teen leader

International law enforcement seized KillSec’s dark web leak site and five core servers and identified a 16-year-old as the suspected administrator and main operator. Authorities executed three provisional arrests and searched eight homes in Greece, Romania, Spain and the UK as part of an inquiry called Operation KillSwitch.

The investigation was led by police and prosecutors in Germany with participation from agencies in Belgium, Finland, the Netherlands, Romania, Spain, Switzerland, the UK and the US. Cybersecurity firms Bitdefender and Group-IB provided technical support to the operation.

Investigators blocked access to at least 110 terabytes of data the group had prepared for publication or free download. KillSec’s domains now redirect visitors to a law enforcement seizure notice and five core servers used to run the operation and hold stolen files were taken offline.

Authorities say KillSec has been active since around 2024. The group gained access to victims by exploiting software vulnerabilities and poorly protected entry points, with a focus on cloud storage systems. After gaining access, members copied internal data to their own infrastructure and in some cases obtained ransoms from corporate victims. Files from organizations that did not pay were sometimes offered as free downloads on the leak site.

Investigators have linked roughly 1,000 suspected attacks to KillSec and are aware of about 500 successful intrusions. The leak site listed roughly 450 victims before it was seized. Authorities executed device seizures and are tracing the group’s financial flows, including cryptocurrency proceeds.

The inquiry remains active as teams analyze seized servers and devices to identify additional victims, attribute more attacks to the group and locate further suspects.