International Police Operation Dismantles KillSec Ransomware Gang, Cites 16-Year-Old Alleged Leader
International law enforcement dismantles the KillSec ransomware operation in a coordinated action dubbed Operation KillSwitch, carried out on September 30. Authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom take part in the sweep, alongside Europol, Eurojust, Bitdefender, and Group-IB. The German-led investigation links the gang to roughly 1,000 suspected attacks worldwide.
Europol identifies a 16-year-old as the group's suspected administrator and main operator, while three suspects face provisional arrest and eight properties undergo searches in Greece, Romania, Spain, and the United Kingdom. Investigators, who begin the probe in 2025, identify suspected roles including an administrator, developer, negotiator, and affiliate. One suspected developer turns 18 in August 2026 and remains a minor when some alleged crimes occur. Police also target the group's criminal proceeds.
Hamburg Police investigate the gang's server infrastructure, leading to the shutdown of five servers, including KillSec's main server and systems used to store stolen data. The gang's dark web data leak site now displays a seizure banner stating that the domain, servers, and associated data are under the control of the State Criminal Police Office of Hamburg and international agencies. The banner links to an Operation KillSwitch website featuring a law enforcement video about the arrests.