Police take down KillSec ransomware gang allegedly run by a 16-year-old

An international law enforcement operation dubbed "Operation KillSwitch" has ended with the seizure of the KillSec ransomware gang's servers and leak site, three arrests, and the identification of a 16-year-old believed to be its administrator.

The coordinated action took place on September 30, involving authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom. Europol and Eurojust joined the investigation, as did security firms Bitdefender and Group-IB.

A German-led investigation

According to Europol, German authorities led the effort, examining around 1,000 suspected attacks worldwide. Investigators believe the gang's main operator is only 16 years old. Another member, described as a developer, turned 18 in August 2026 and was still a minor when some of the alleged crimes were committed. Suspected negotiator and affiliate roles have also been identified.

The probe began in 2025. Hamburg Police examined the group's server infrastructure, leading to the identification and shutdown of five servers, including KillSec's main server and several used to store stolen data. Among the seized assets is the gang's dark web leak site, which now displays a seizure notice.

The scale of the operation

The action included eight searches in Greece, Romania, Spain, and the United Kingdom, with three suspects provisionally arrested. Police seized at least 110 terabytes of stolen data. Of the roughly 1,000 attacks, investigators estimate about 500 were successful, though the figures may still change. At least 70 are linked to German organizations, 18 of them to Hamburg.

KillSec has operated since around 2024. It is accused of exploiting software flaws and poorly secured edge devices to breach corporate systems and steal data, then extorting victims under threat of publication. Europol says the group collected "substantial" ransom payments.

One telling detail: investigators found that members used artificial intelligence to help build and maintain their infrastructure and to pick targets. Authorities are now analyzing the seized hardware and tracing the gang's proceeds, including cryptocurrency; the evidence could reveal further victims and accomplices.

Source: Bleeping Computer