Skip to content
Police Dismantle KillSec Ransomware Gang Led by Teenager

Police Dismantle KillSec Ransomware Gang Led by Teenager

First seen 1 Oct 2026, 16:02 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 17:05 UTC
  • •KillSec ransomware gang dismantled in international operation.
  • •16-year-old identified as the main operator; three arrests made.
  • •Authorities seized 110TB of stolen data and took control of key servers.

On October 1, 2026, law enforcement agencies, including Europol, announced the dismantling of the KillSec ransomware group, allegedly led by a 16-year-old. The operation, named 'Operation KillSwitch', resulted in three provisional arrests and the seizure of at least 110 terabytes of stolen data. The group is linked to approximately 1,000 suspected attacks globally, with around 500 confirmed successful breaches. KillSec exploited software vulnerabilities and poorly secured systems to infiltrate organizations, particularly targeting cloud storage. Investigators have identified a developer who recently turned 18, as well as a negotiator and an affiliate. The group's dark web leak site has been taken over by authorities, and its domains now display a seizure notice. The investigation began in 2025, and authorities continue to analyze seized data to trace criminal proceeds and identify additional victims.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-30
Operation KillSwitch executed
Law enforcement agencies conducted coordinated raids, leading to three arrests and the seizure of KillSec's servers and data leak site.
BleepingComputer
2026-10-01
KillSec operation announced
Europol announced the dismantling of the KillSec ransomware gang and identified a 16-year-old as the group's leader.
Securityweek

More articles in this cluster (6)

Following this threat?

Track KillSec in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3

Common questions

What organizations were affected?
The KillSec gang is linked to around 1,000 suspected attacks, with approximately 500 confirmed successful breaches globally.
What should organizations do now?
Organizations should review their security measures, especially around cloud storage, and monitor for any signs of compromise.
Is the threat from KillSec eliminated?
While key members have been arrested, investigations are ongoing, and organizations should remain vigilant against potential remaining affiliates.