[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [CRIME]

2 clusters · 45 sources · 3 days · First seen · Last updated

Dismantling of KillSec ransomware group

Overview

International law enforcement agencies, led by German authorities with support from Europol and Eurojust, dismantled the KillSec ransomware group through a coordinated effort called ‘Operation KillSwitch’. The group is suspected of conducting approximately 1,000 cyberattacks worldwide, with roughly 500 confirmed successful breaches since 2024.

KillSec employed a ‘double extortion’ model, exploiting software vulnerabilities and cloud storage to steal sensitive information. The group would encrypt data and threaten to publish it on a dark web leak site unless ransoms were paid.

The operation involved agencies from nine countries and resulted in three arrests, including a 16-year-old Romanian national suspected of being the group’s primary administrator and a developer. In the United Kingdom, Fouad Eltibrizi, a Dutch national, was arrested pending extradition to the United States.

Authorities conducted searches at eight properties across Spain, Greece, Romania, and the UK, seizing digital evidence such as laptops, mobile phones, and hard drives. Investigators also seized five central servers, took control of the group’s leak site, and secured at least 110 terabytes of stolen data along with cryptocurrency wallets.

Entities

Eurojust · KillSec · Europol · Cato Networks · FBI

Timeline

  1. [CRIME] 8 sources
    KillSec ransomware gang dismantled in international operation

    Authorities dismantled the KillSec ransomware gang following 1,000 attacks. The operation led to three arrests, including a 16-year-old suspected leader, and the seizure of 110 terabytes of data.

  2. [TECHNOLOGY] 38 sources
    KillSec ransomware group dismantled in international Operation KillSwitch

    International authorities dismantled the KillSec ransomware group in Operation KillSwitch, arresting three suspects, including a 16-year-old alleged leader, and seizing 110TB of stolen data.

Sources

20minutos.com.mx · 324.cat · aduc.it · aftodioikisi.gr · agrinionews.gr · alfavita.gr · athina984.gr · blocktempo.com · chip.cz · cretaone.gr · cybernoz.com · elcatalan.es · elliberal.cat · entrevue.fr · flash.gr · greekcitytimes.com · gulfnews.com · index.hr · it-boltwise.de · it-daily.net · itnerd.blog · kefaloniamagazine.gr · lawandorder.gr · maps.in.gr · merca2.es · moncloa.com · mopo.de · nyheder-i-dag.dk · orthodoxtimes.gr · ot.gr · piracymonitor.org · que.com · real.gr · saferworld.org.uk · sanjuandailystar.com · sapo.pt · securityaffairs.co · tanea.gr · technadu.com · thebest.gr · theregister.co.uk · tokenpost.com · tromaktiko.gr · vecernji.hr · viaempresa.cat