Police take down dangerous KillSec ransomware gang — and find out it's being run by a teenager

Operation KillSwitch dismantled KillSec, seizing infrastructure, cryptocurrency, and 110TB data Investigation identified core members; several arrests made, including key operators KillSec claimed 1,000 attacks, targeting healthcare, finance, government, and SMBs The infamous ransomware group KillSe

<![CDATA[ <article> <ul><li><strong>Operation KillSwitch dismantled KillSec, seizing infrastructure, cryptocurrency, and 110TB data</strong></li><li><strong>Investigation identified core members; several arrests made, including key operators</strong></li><li><strong>KillSec claimed 1,000 attacks, targeting healthcare, finance, government, and SMBs</strong></li></ul><p>The infamous <a href="https://www.techradar.com/best/best-ransomware-protection" target="_blank">ransomware</a> group KillSec is no more after Europol, together with multiple national law enforcement agencies and cybersecurity companies, seized the group’s infrastructure and data, made a few arrests, and even identified the group’s leader.</p><p>On September 30, law enforcement kicked off Operation KillSwitch. It was led by German authorities, with assistance from numerous other agencies: Europol, Eurojust, as well as authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom, and the United States. </p><p>Private cybersecurity companies such as Group-IB also participated with vital intelligence, having labeled KillSec one of the most active ransomware groups in 2025 in Asia-Pacific, Latin America, and the Middle East.</p><h2 id="operation-killswitch">Operation KillSwitch</h2><p>KillSec emerged as a serious threat actor some time in 2024, Europol said. Over the next two years, it made roughly 1,000 attacks worldwide, at least half of which were, most likely, successful. KillSec primarily targeted small-to-midsize organizations, often in professional services, technology, healthcare, or financial services.</p><p> They targeted mostly organizations with valuable or otherwise sensitive data, and potentially weakly secured internet and <a href="https://www.techradar.com/best/best-cloud-storage" target="_blank">cloud infrastructure</a>. Large enterprise and government organizations also appeared, but company size does not seem to have been the primary selection criterion.</p><p>Law enforcement started investigating the group in 2025, Europol said, and quickly determined that it comprised at least four people: the ringleader, the developer, the negotiator, and an affiliate. The ringleader’s identity was not publicly disclosed because the person is 16 years old. The main developer recently turned 18, but many of the crimes he did were done when he was a minor. There is also a possibility the group was even bigger - the investigation is still ongoing.</p><p>Group-IB analysts had identified at least 274 victim organizations, most of which (35%) were from the United States. </p><p>These are followed by India (17%), Brazil, the UK, Australia, and Colombia (3% each). It primarily targeted financial services and healthcare firms, but did not shy away from government organizations and large enterprises. Among its victims, Group-IB claims, is a “major insurer, investment firms, and a consumer app with millions of users.”</p><h2 id="multiple-arrests">Multiple arrests</h2><p>During the operation, three people seem to have been arrested. Europol’s wording is somewhat vague, but it seems the ringleader is not among them. The police confiscated 110 terabytes of data as well as “the group’s criminal proceeds” (cryptocurrency extorted from victim organizations, mostly). They seized five central servers as well as the infrastructure used to manage the group’s activities and store stolen data. Multiple domains used by KillSec were nabbed, as well, and now show the usual seizure notice. </p><p>The police carried out eight house searches across Europe, in Spain; Greece, Romania, and the United Kingdom. </p><p>Initially, KillSec focused on the Windows platform. However, in late 2024 it released its KillSec 2.0 affiliate platform which soon expanded into VMware ESXi virtualization hosts that were capable of shutting down virtual machines, delete snapshots, erase logs, and more. By January 2025, the group was openly recruiting “skilled pentesters”, requiring a forum reputation or a USD 1,000 deposit. </p><p>It demanded 20% of each ransom from its affiliates. </p><p>“KillSec's affiliates went after the organizations people depend on most: hospitals, government bodies, and financial institutions. Closing the gaps these groups exploit is essential, but it does not end an operation like this. Servers can be replaced in weeks; the people who build the platform and approve every attack cannot. Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end. We are proud to have contributed to Operation KillSwitch, and will continue to support Europol and our law enforcement partners in the fight against cybercrime,” said Dmitry Volkov, CEO of Group-IB.</p> </article> ]]>