Police Arrest Suspected KillSec Operator, Seize Ransomware Leak Site
Summary
Police across six countries arrested three people and seized KillSec’s leak site, servers and data. Investigators link the suspected ransomware group to more than 280 victims and about 1,000 suspected attacks; the investigation continues.
Key points
- A 16-year-old suspected of administering and operating KillSec was arrested in Spain; two other people were arrested in the U.K. and Romania.
- Authorities took control of KillSec’s leak site, secured at least 110 terabytes of data, shut down five servers and placed seizure notices on five domains.
- Investigators are examining seized evidence and tracing the group’s finances, including cryptocurrency, while inquiries into other possible members continue.
- Authorities are investigating about 1,000 suspected attacks, of which roughly 500 have been identified as successful so far.
- Spanish police report more than 280 victims; investigators say the group stole data and used ransom demands and threats to publish or sell it for extortion.
- Police say KillSec exploited software vulnerabilities and poorly secured access points, particularly cloud storage, and also used credentials bought on the dark web.
- Hamburg police say the group used AI to build and operate infrastructure and identify potential victims, but provided no further details.
Article Details
- Event Type
- International law-enforcement operation involving arrests, searches, and the seizure of KillSec infrastructure.
- Impact
- Authorities arrested three people, including a 16-year-old suspected of administering and operating KillSec, seized its leak site and secured at least 110 terabytes of data, and shut down five servers. Investigators linked the group to more than 280 victims and approximately 1,000 suspected attacks, while noting those figures may change as they examine the seized evidence. The investigation and tracing of possible additional members, victims, attacks, and funds continue.
Threat Actors
Malware
Vendors
BitdefenderEuropol and the EU’s judicial cooperation agency, Eurojust, coordinated the work, and security companies Bitdefender and Group-IB supported the investigation.Group-IBEuropol and the EU’s judicial cooperation agency, Eurojust, coordinated the work, and security companies Bitdefender and Group-IB supported the investigation.Rapid7Security company Rapid7 reported in 2025 that KillSec began as a hacktivist group, active since at least 2021, and turned to ransomware in October 2023.
Countries
GermanyPolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.GreecePolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.RomaniaPolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.SpainPolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.United KingdomPolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.United StatesPolice in Spain, Germany, Romania, the U.K., Greece, and the U.S.