Eurojust (Organization): news timeline & CVEs

Teenagers suspected of leading KillSec ransom group arrested during international operation

An international operation arrested three suspects, including teenagers, accused of leading the KillSec ransomware group.

Eurojust and Europol coordinated authorities from nine countries in an operation that disrupted the KillSec ransomware group, blamed for almost 1,000 attacks worldwide since 2024. Investigators say a 16-year-old was the main operator and that another suspect, a developer who recently turned 18, was a minor during some alleged offenses. KillSec accessed poorly secured systems, particularly cloud storage, stole data, and extorted victims by threatening publication. The action day produced three arrests, eight house searches, seizure of five servers and KillSec domains, and recovery of at least 110 terabytes of stolen data.

DataBreaches.netupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 19:29 UTC · 4h agoPolicy & legal 10 sources

Operation KillSwitch: Police Dismantle KillSec Ransomware Group

Europol's Operation KillSwitch dismantled KillSec ransomware after about 500 confirmed attacks and seized 110 terabytes.

On 30 September 2026, Europol said Operation KillSwitch, led by Germany, dismantled the KillSec ransomware group. Authorities seized its Tor leak site and at least 110 terabytes of stolen data, took five central servers and the group's domains, arrested three suspects, and searched eight properties in Greece, Romania, Spain, and the UK. Investigators are reviewing about 1,000 suspected attacks since around 2024, with roughly 500 confirmed; KillSec exploited software flaws and weak access, often cloud storage, then demanded payment to withhold stolen files. The alleged lead operator is 16, another suspect was under 18 for some offenses, and police said the crew used AI to build its infrastructure and choose victims.

Security Affairsupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 18:08 UTC · 6h agoRansomware 10 sources

Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers

Spanish police arrested a suspected 16-year-old KillSec administrator; joint operation seized the ransomware group's leak site, 110 TB of data and five servers.

Hamburg-led police with Spain's Guardia Civil and Mossos d'Esquadra arrested a 16-year-old in Alicante suspected of being KillSec's main administrator; two other suspects were arrested in the UK and Romania. Authorities seized the leak site securing at least 110 TB of data, shut down five servers including KillSec's main server, and placed seizure notices on five domains. The investigation covers about 1,000 suspected attacks worldwide with roughly 500 identified as successful, and Spanish police count more than 280 victims. KillSec, which evolved from hacktivism to ransomware-as-a-service in June 2024 with KillSecurity 2.0 and 3.0, exploited software vulnerabilities and bought dark-web credentials to steal and extort data.

The Hacker Newsupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 16:55 UTC · 7h agoRansomware 10 sources

16-year-old Alleged KillSec Ransomware Group Leader Arrested, Servers Dismantled

Nine-country operation arrests three KillSec ransomware members, including a suspected 16-year-old leader, and seizes five servers plus 110TB of stolen data.

An international operation coordinated by Eurojust and Europol identified a 16-year-old as the suspected administrator and main operator of the KillSec ransomware group, which is linked to almost 1,000 incidents worldwide since 2024. Authorities in Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the UK, and the US carried out eight searches, seized at least 110TB of stolen data, took control of five servers, and seized KillSec domains. The group used double extortion, entering via software weaknesses and poorly protected access points, with cloud-storage environments a key target. A suspected developer, recently turned 18, was also identified, and investigations continue into victims, members, and financial proceeds.

Cyber Security Newsupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 15:30 UTC · 8h agoPolicy & legal in the wild 10 sources

Police dismantle KillSec ransomware gang allegedly led by 16-year-old

International Operation KillSwitch seized KillSec's servers and leak site, arrested three suspects, and identified a 16-year-old as the ransomware gang's leader.

Operation KillSwitch, led by German authorities with Europol, Eurojust, and agencies from ten countries, seized KillSec's dark web leak site and five servers, provisionally arrested three suspects, and searched eight properties on September 30. Investigators identified a 16-year-old as the gang's suspected administrator and main operator. The probe covers roughly 1,000 suspected attacks since 2024, with about 500 deemed successful, including 70 against German organizations, and law enforcement seized 110 TB of stolen data. Europol says KillSec received substantial ransoms after exploiting edge device vulnerabilities, and that members used AI to build ransomware infrastructure and identify victims.

BleepingComputerupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 14:25 UTC · 9h agoRansomware in the wild 10 sources

16-year-old suspected leader of KillSec ransomware group arrested

Eurojust says a 16-year-old suspected KillSec leader was arrested after nearly 1,000 ransomware attacks.

Eurojust said a coordinated operation produced three arrests, including a 16-year-old suspected of being KillSec's administrator and main operator, and eight searches in Spain, Greece, the United Kingdom, and Romania. KillSec, active since 2024, is accused of nearly 1,000 attacks worldwide: it entered organizations through poorly secured access, particularly cloud storage, stole data, and threatened to publish it unless a ransom was paid. Authorities seized at least 110 terabytes of stolen data, five servers used to store victim files, and KillSec-operated domains. Eurojust coordinated nine countries, while Europol supported cryptocurrency tracing and the FBI's San Juan Field Office took part.

Help Net Securityupdated Oct 1, 21:37 UTC · 2h agofirst Oct 1, 13:59 UTC · 10h agoRansomware in the wild 10 sources

Oxygen Forensics, A Russian-run forensics firm spent a decade inside European police departments

DOJ charged Oxygen Forensics leaders for hiding Russian ownership while selling forensic tools to US and European agencies.

The US Justice Department charged Oxygen Forensics CEO Lee Reiber and Russian co-founder Oleg Davydov with concealing that Russian nationals owned the company and that its software was developed in Russia while selling forensic tools to the Pentagon, Secret Service, and other US agencies. Politico reports Oxygen was consulted on the EU-funded EVIDENCE and INSPECTr digital-evidence projects, and police in Germany, Spain, Italy, Poland, Hungary, Romania, and Latvia bought or accredited its products. The same five owners allegedly controlled Russia's MKO Systems, which sold the technology to the FSB and Interior Ministry. Romania's National Anticorruption Directorate said it will stop using the products.

Security AffairsSep 30, 13:26 UTC · 1d agoPolicy & legal

Eurojust

Timeline7 articles

Appears with