16-year-old suspected leader of KillSec ransomware group arrested

A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide.

Seizure notice (Source: Eurojust)

According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage.

“Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download,” Eurojust said.

“To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments,” it added .

Authorities identified suspects acting as administrator, developer, negotiator and affiliate. A teenager is suspected of being the group’s administrator and main operator.

Another suspect, a developer, recently turned 18 and was a minor when some of the alleged offences were committed, Eurojust noted. The group members used aliases online to hide their identities and talked through encrypted messaging services.

The action day ended with three arrests and the seizure of evidence and assets. Officers carried out eight house searches in Spain, Greece, the United Kingdom and Romania.

Authorities secured at least 110 terabytes of stolen data. During the investigation, they seized five servers the group used to store victim data, along with domains operated by KillSec.

Investigators will examine the seized devices and data and trace the group’s financial proceeds. This evidence may help identify other victims, attacks and people involved.

Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States. Authorities from Belgium, Germany, Greece and Romania set up a joint investigation team at Eurojust, and the action day was run from a coordination centre at the agency.

The agencies involved include Germany’s Federal Criminal Police Office, the UK’s Eastern Region Special Operations Unit, Spain’s Mossos d’Esquadra and Guardia Civil, and the FBI’s San Juan Field Office.

Europol produced reports on the group’s activities and put investigators in touch with private sector partners. It also provided specialist support to trace cryptocurrency and examine digital evidence.