Police disrupt KillSec ransomware, arrest suspected teenage leader
Spanish police arrested KillSec's suspected 16-year-old leader and seized the ransomware gang's leak site, five servers, and infrastructure across Europe.
An international operation based in Hamburg arrested the suspected Romanian-national 16-year-old leader of KillSec in Alicante, plus two others, raiding eight houses across Greece, Romania, Britain, and Spain. Authorities seized five servers and the group's Tor-accessible leak site; KillSec launched roughly 1,000 attacks since 2024, at least half successful, extorting healthcare, government, and financial victims after exploiting cloud-storage vulnerabilities. Europol's European Cybercrime Centre, Bitdefender, and Group-IB supported the investigation.
- KillSec linked to ~1,000 attacks since 2024, at least half successful
- Group offered cheap ransomware-as-a-service with Tor control panel and custom tools
- Raids across Spain, Greece, Romania, UK; five servers seized
- At least four suspected members identified; others under investigation
Full article349 words · extracted from therecord.media · click to collapse
Spanish police announced the arrest Thursday of the 16-year-old suspected leader of the KillSec ransomware group as part of an international operation that also saw the seizure of the group’s leak site and infrastructure. Catalan authorities, alongside the Civil Guard’s cybercrime unit, arrested the minor in the town of Alicante. According to Reuters, he is a Romanian national. Police raided eight houses as part of the operation, in Greece, Romania, Britain and Spain, and seized five servers allegedly used to manage the group’s activities and store stolen data. Two other arrests were made, police said. Since it emerged in 2024, KillSec has launched around 1,000 attacks, at least half of which were successful, authorities said. The group exploited vulnerabilities, especially in cloud storage, in order to infiltrate systems and extract sensitive data. Victims were listed on the group’s leak site and extorted with the threat of the release of data. Police in Hamburg, where the operation was based, said authorities in several countries began investigating the group in early 2025 following attacks. They were able to identify at least four suspected members and are investigating others. One suspected developer turned 18 in August, they said. The European Cybercrime Centre, an entity created by Europol for cross-border coordination, provided insights into the group and technical support. The cybersecurity companies BitDefender and Group-IB were also involved in the investigation, as well as police in Switzerland, the U.K., U.S., Romania, Spain, Greece, the Netherlands, Finland and Belgium. According to the cyber firm Halcyon, KillSec offered one of the most affordable ransomware-as-a-service platforms in the ecosystem. Its Tor-accessible control panel including chat functionality and custom ransomware tools allowed cybercriminals with limited technical skills to carry out attacks. Their compromise of cloud security vulnerabilities was spread among healthcare companies, government entities, financial services firms, and others.
No previous article
No new articles
James Reddick
has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.