Police have taken down KillSec, a ransomware crew that squeezed roughly 1,000 victims, and detained a teenager they call its main operator.
The action, dubbed Operation KillSwitch and led by German authorities, seized the group’s dark web leak site on September 30. That single move froze more than 110 terabytes of stolen data. Officers arrested three suspects and searched eight properties across Greece, Romania, Spain, and the United Kingdom.
Investigators have confirmed about 500 of the suspected attacks as successful, a figure they expect to move as seized evidence is worked through.
KillSec has operated since around 2024, breaking in through software flaws and weak access controls, often hitting cloud storage. It then threatened to publish what it stole unless victims paid.
One detail stands out. Police say the group leaned on AI to build and maintain its infrastructure and to pick targets, a sign that automation is spreading through even small, young crews.
The suspected ringleader is 16. A second suspect seen as a developer turned 18 in August 2026. Ten countries joined the effort, with Europol and Eurojust coordinating.
Authorities brought five central servers under control, seized the group’s domains, and redirected visitors to a law enforcement notice. Police are now working through devices, tracing cryptocurrency, and following leads that could name more victims and more suspects.
