KillSec ransomware gang dismantled in international operation

International authorities have dismantled the infrastructure of KillSec, a ransomware gang responsible for approximately 1,000 cyberattacks worldwide. The crackdown, known as ‘Operation KillSwitch’, was led by German criminal police in coordination with the Hamburg prosecutor's office, with support from Europol and Eurojust.

The operation resulted in three arrests and eight simultaneous searches across Greece, Romania, Spain, and the United Kingdom. Notably, investigators identified a 16-year-old Romanian national as the group's suspected primary administrator and operator. Another suspect, the developer of the group's ransomware, was also identified as a minor at the time of the alleged offenses.

KillSec utilized a ‘double extortion’ model, targeting poorly protected cloud storage and exploiting known vulnerabilities. The group would encrypt victim data to deny access and subsequently threaten to publish the stolen information on a leak site unless a ransom was paid. During the operation, authorities seized 110 terabytes of data, five servers, and various electronic devices and cryptocurrency wallets.