16-year-old suspected leader of KillSec ransomware group arrested
Eurojust says a 16-year-old suspected KillSec leader was arrested after nearly 1,000 ransomware attacks.
Eurojust said a coordinated operation produced three arrests, including a 16-year-old suspected of being KillSec's administrator and main operator, and eight searches in Spain, Greece, the United Kingdom, and Romania. KillSec, active since 2024, is accused of nearly 1,000 attacks worldwide: it entered organizations through poorly secured access, particularly cloud storage, stole data, and threatened to publish it unless a ransom was paid. Authorities seized at least 110 terabytes of stolen data, five servers used to store victim files, and KillSec-operated domains. Eurojust coordinated nine countries, while Europol supported cryptocurrency tracing and the FBI's San Juan Field Office took part.
- A 16-year-old is suspected to be KillSec's main operator.
- Eurojust says the group carried out almost 1,000 attacks since 2024.
- Attackers stole data via poorly secured access, especially cloud storage, then extorted victims.
- Authorities seized 110 terabytes of stolen data, five servers, and KillSec domains.
Full article370 words · extracted from helpnetsecurity.com · click to collapse
A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide.
Seizure notice (Source: Eurojust)
According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage.
“Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download,” Eurojust said.
“To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments,” it added.
Authorities identified suspects acting as administrator, developer, negotiator and affiliate. A teenager is suspected of being the group’s administrator and main operator.
Another suspect, a developer, recently turned 18 and was a minor when some of the alleged offences were committed, Eurojust noted. The group members used aliases online to hide their identities and talked through encrypted messaging services.
The action day ended with three arrests and the seizure of evidence and assets. Officers carried out eight house searches in Spain, Greece, the United Kingdom and Romania.
Authorities secured at least 110 terabytes of stolen data. During the investigation, they seized five servers the group used to store victim data, along with domains operated by KillSec.
Investigators will examine the seized devices and data and trace the group’s financial proceeds. This evidence may help identify other victims, attacks and people involved.
Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States. Authorities from Belgium, Germany, Greece and Romania set up a joint investigation team at Eurojust, and the action day was run from a coordination centre at the agency.
The agencies involved include Germany’s Federal Criminal Police Office, the UK’s Eastern Region Special Operations Unit, Spain’s Mossos d’Esquadra and Guardia Civil, and the FBI’s San Juan Field Office.
Europol produced reports on the group’s activities and put investigators in touch with private sector partners. It also provided specialist support to trace cryptocurrency and examine digital evidence.