An international law enforcement operation has seized the infrastructure of the KillSec ransomware gang and made three provisional arrests, including a suspect believed to be just 16 years old and allegedly the group’s main operator. The takedown, named Operation KillSwitch, was carried out on September 30, 2026, and is one of the largest ransomware disruptions of the year.
A coordinated raid across multiple countries
The operation brought together police and prosecutors from Germany, Belgium, Finland, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom, and the United States, with coordination support from Europol and Eurojust. Cybersecurity firms Bitdefender and Group-IB assisted investigators with technical analysis.
Authorities carried out eight property searches across Greece, Romania, Spain, and the United Kingdom, resulting in three provisional arrests. Investigators seized KillSec’s dark web data leak site along with five servers that formed the core of the group’s infrastructure, including systems used to store stolen victim data. Police said they secured roughly 110 terabytes of stolen information to prevent it from being published or sold further.
Europol identified the suspected leader and administrator of KillSec as a 16-year-old, still a minor under investigation. A second suspect, described as the group’s developer, turned 18 in August 2026 but is believed to have been a minor during some of the alleged offenses. Investigators also identified individuals suspected of acting as a negotiator and an affiliate, and said the search for additional members is continuing.
How KillSec operated
KillSec had been active since approximately 2024, and the investigation that led to its takedown began in 2025. Authorities say the group was linked to around 1,000 suspected attacks worldwide, of which roughly 500 are believed to have succeeded. Before the leak site was seized, it listed close to 450 victims. Germany was hit particularly hard, with at least 70 attacks against German organizations, 18 of them in Hamburg alone.
Rather than always relying on custom malware, KillSec’s members are alleged to have broken in primarily by exploiting known software vulnerabilities and poorly secured edge devices and cloud storage systems. Investigators say the group also used artificial intelligence tools to help build its ransomware infrastructure and to identify potential victims, reflecting a broader trend of cybercriminal groups adopting AI to scale operations with fewer people. Once inside a network, the gang’s typical approach was to copy sensitive data rather than necessarily encrypt it, then threaten to publish the stolen files unless a ransom was paid. Investigators say some victims paid substantial ransoms, though no specific amounts have been disclosed publicly.
No CVE or specific list of exploited vulnerabilities has been published in connection with the case as of this writing, and authorities have not named any of the three people arrested, consistent with standard practice when minors are involved in an investigation.
The case is a reminder that ransomware operations are no longer necessarily run by large, organized criminal syndicates. Investigators increasingly describe these groups as small, loosely structured teams, sometimes involving members who are still teenagers, capable of causing damage at a scale once associated only with professional crime rings.
Source: BleepingComputer, with additional reporting from SecurityWeek.
[…] International Police Operation Dismantles KillSec Ransomware Gang, Suspected Leader Is 16 […]