Police dismantled KillSec ransomware gang. It was allegedly led by a sixteen-year-old

Most people would probably associate ransomware gangs with seasoned professionals from organized crime. However, according to European police forces, the KillSec group, which investigators say extorted companies and institutions worldwide with stolen data, was mainly composed of teenagers. Its alleged leader, a sixteen-year-old boy, was arrested by Spanish police as part of the international operation KillSwitch.

Sixteen-year-old leader arrested in Spain

The arrest took place in Alicante, Spain, and according to local police, the detainee is a Romanian national. A Europol spokesperson confirmed to Reuters that investigators suspect him of being the group’s administrator and main operator.

Police also arrested two men in their twenties, one in Britain and the other in Romania. According to Europol, authorities in Puerto Rico have already requested the extradition of the man arrested in Britain. Investigators further identified an alleged developer who only turned 18 in August, meaning he committed part of the criminal activity while still a minor. He has not yet been arrested. The roles of a negotiator and a so-called affiliate, a partner who carried out attacks for the gang, are also being considered. The search for other potential members continues.

How did KillSec attack?

The group had been active since approximately 2024. According to Europol, it gained access to victims’ systems through unpatched software vulnerabilities and poorly secured access points, especially to cloud storage. Its members then copied sensitive internal data to their own servers.

Extortion followed. The gang publicly named victims on its dark web site and threatened to publish their data if a ransom was not paid. Those who did not pay could have their files made freely available for download. In some cases, according to Europol, the group collected “significant” sums.

Investigators also found that gang members used artificial intelligence to build and maintain their infrastructure and to identify potential victims. Precisely because of the risk of similar misuse, Google has so far entrusted its most powerful model, Gemini 4 Argon, only to cybersecurity experts, as we reported a few days ago.

Police seized attackers’ website and are tracking their transactions

The main operation took place on September 30. Police conducted eight house searches in Spain, Greece, Romania, and the United Kingdom and seized evidence and assets. During the investigation, five key servers, including the group’s main server and machines where the gang stored stolen data, came under the control of investigators.

Police also took over the website where the gang exposed victims and secured at least 110 terabytes of data on it to prevent further access. Visitors to the group’s domains are now greeted by a seizure notice instead of threats. Investigators are also tracking the gang’s financial flows, including cryptocurrencies.

The operation was led by the State Criminal Police Office in Hamburg together with the Hamburg Public Prosecutor’s Office. Authorities from ten countries, including the USA, as well as Europol, Eurojust, and security companies Bitdefender and Group-IB, were involved. Of the approximately one thousand attacks attributed to the group by investigators, at least 70 targeted entities in Germany, and 18 of these had a direct connection to Hamburg. So far, police have confirmed approximately 500 successful attacks, but these numbers may change with further examination of the seized data. Investigators did not release data on victims in other countries, including the Czech Republic.

Were you surprised that teenagers were allegedly behind hundreds of successful attacks?

Sources: Europol, Hamburg Police, Reuters, BleepingComputer