European and international law-enforcement authorities have arrested three suspects linked to the KillSec ransomware group, including a 16-year-old alleged to have served as the operation’s main administrator and operator.
The coordinated action targeted a group accused of carrying out nearly 1,000 cyberattacks globally since emerging in 2024.
Eurojust and Europol coordinated the multinational investigation, which brought together authorities in Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom, and the United States.
16-Year-Old Alleged KillSec Ransomware Operator Arrested
Investigators conducted eight house searches across Spain, Greece, the UK, and Romania, seizing evidence, assets, five servers, domains used by KillSec, and at least 110 TB of allegedly stolen victim data.
According to Eurojust, KillSec’s intrusion model focused on exploiting inadequately secured access points, with cloud-storage-related services identified as a particular area of exposure.
After gaining access to victim environments, the group allegedly exfiltrated sensitive files and transferred them to infrastructure under its control.
The actors then used the stolen data as leverage, demanding ransom payments in exchange for not publishing the material. The operation reportedly followed a data-extortion playbook rather than relying solely on encryption-based ransomware disruption.
Victims received samples of their stolen data as proof of compromise, while organizations that did not meet payment demands risked having their files released online for free download. Eurojust said the group received substantial ransom payments in some cases.
Authorities identified suspects associated with several operational roles, including administrator, developer, negotiator, and affiliate. The 16-year-old suspect is alleged to have been KillSec’s administrator and principal operator.
A second suspect, described as a developer who recently turned 18, was reportedly still a minor when some of the alleged offenses took place. The suspects allegedly used online aliases to obscure their identities and relied on encrypted messaging platforms for communications.
The investigation demonstrates how ransomware and extortion ecosystems can operate through distributed, role-based structures. Rather than requiring every participant to perform intrusions, infrastructure management, negotiations, and data publication, groups can divide those functions among separate operators.
This model can enable younger or less technically experienced individuals to participate in high-impact cybercrime operations while concealing their identities behind encrypted services, cryptocurrency transactions, and pseudonymous accounts.
Eurojust established a joint investigation team involving authorities from Belgium, Germany, Greece, and Romania.
The agency also hosted an operational coordination centre for the international action day, supporting the identification of suspects, infrastructure mapping, evidence seizures, and financial-trail analysis.
Europol contributed intelligence reporting, digital-forensics support, private-sector coordination, and cryptocurrency tracing capabilities.
Authorities will analyze the seized devices, servers, and stolen data to identify additional victims, attacks, infrastructure, financial proceeds, and potential accomplices.
For defenders, the case reinforces the need to harden cloud-facing access points, enforce multifactor authentication, monitor for abnormal data transfers, and maintain tested incident-response procedures for data-theft extortion events.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
