Police dismantle KillSec ransomware gang allegedly led by 16-year-old

Key Points:

• Operation KillSwitch, a multinational law enforcement effort involving 11 countries and agencies like Europol and Eurojust, dismantled the KillSec ransomware gang’s data leak site and servers, leading to three arrests and multiple property searches.
• The investigation, which began in 2025, identified a 16-year-old as the gang’s alleged main operator, with other suspects including a developer who was a minor during some crimes, a negotiator, and an affiliate.
• Authorities seized KillSec’s dark web leak site, over 110 terabytes of stolen data, and shut down five servers, disrupting the gang’s infrastructure and preventing further unauthorized access.
• KillSec, active since 2024, conducted around 1,000 attacks exploiting software vulnerabilities and weak security, successfully compromising about 500 organizations, including at least 70 in Germany.
• Investigators found that the group used artificial intelligence to develop their ransomware tools and target victims, and they are now tracing criminal proceeds, including cryptocurrency, while analyzing seized evidence for additional leads.