KillSec ransomware leak site seized in police operation

KillSec ransomware infrastructure has been taken over in a police operation that also led to three arrests in Spain, the U.K. and Romania, according to statements from European law enforcement agencies and reporting cited by Reuters. Investigators suspect the group stole data from organizations, listed victims on a dark web leak site and demanded payment to keep the files from being published.

Police in Spain arrested a 16-year-old in Alicante on September 30. Hamburg police said on October 1 that investigators identified the teenager as KillSec's suspected administrator and main operator. A joint statement from the Guardia Civil and the Mossos d'Esquadra, carried by elperiodic.com, described the teenager as one of the group's administrators and its presumed main administrator. Officers searched a home and an office at a hotel in Alicante province.

Two other people were arrested the same day, one in the U.K. and one in Romania. A Europol spokesperson told Reuters that both were in their 20s. U.S. prosecutors in Puerto Rico and the Federal Bureau of Investigation's San Juan office also took part in the operation, and Puerto Rico has filed an extradition request for the person arrested in the U.K., according to the Europol spokesperson.

In Romania, prosecutors from DIICOT, the country's organized crime and terrorism directorate, detained a 24-year-old and searched four homes in Bucharest and Vaslui county. DIICOT said the person is under investigation for forming an organized criminal group, illegal access to a computer system, unauthorized transfer of computer data, illegal operations with devices or software, and blackmail. On October 1, prosecutors asked a Bucharest court to hold the suspect for 30 days. He is presumed innocent. Hamburg police described all three arrests as provisional.

The investigation identified suspects in four roles: an administrator, a developer, a negotiator and an affiliate. In ransomware operations, an affiliate is an outside partner who uses a group's tools to carry out attacks. Reuters reported that the suspected developer turned 18 in August and was a minor when some alleged offenses occurred. The developer has been identified but not arrested. Hamburg police and DIICOT did not state which roles were allegedly held by the people arrested in the U.K. and Romania.

Police carried out eight searches in Spain, Greece, the U.K. and Romania. When authorities took control of the leak site, they secured at least 110 terabytes of data against further unauthorized access. Hamburg investigators also shut down five servers, including KillSec's main server and several servers allegedly used to store data taken from victims. Police seizure notices were placed on five of the group's domains.

Spanish police said officers seized computer equipment, phones and cryptocurrency wallets. A first analysis found transactions matching ransom payments from some victims, according to Spanish police. Investigators are now examining seized devices and data and tracing money, including cryptocurrency, which may identify more victims, attacks and suspects.

The Spanish Guardia Civil's investigation began in 2025 through cooperation with the FBI office in San Juan, Puerto Rico, focused on finding people linked to KillSec who might be living in Spain. Spanish investigators said they started from a single profile image and identified the suspect in Alicante province. The Mossos d'Esquadra opened a separate case after an early 2025 attack on a Catalan organization that they suspect was carried out by KillSec. The damage from that incident was put at close to €1 million.

Authorities in several countries began investigating attacks attributed to KillSec in early 2025. Europol and Eurojust, the European Union's judicial cooperation agency, coordinated the work. Security companies Bitdefender and Group-IB supported the investigation. Eurojust said the participating authorities had shut down a ransomware group and would continue the investigation, while Hamburg police said inquiries into other possible members were continuing.

Hamburg police said KillSec gained access to organizations by exploiting software vulnerabilities and poorly secured access points, especially cloud storage. A software vulnerability is a flaw that can let an attacker get into or misuse a system. Cloud storage is online storage run through internet services rather than a device kept in the office. After gaining access, KillSec members allegedly copied sensitive internal data to servers they controlled.

The group then named victims on a dark web leak site. The dark web is a part of the internet that is not reached through ordinary search engines and is often accessed with special tools. Victims were threatened with publication of their stolen data unless they paid. If they did not pay, the files could be offered for free download. DIICOT prosecutors also said members bought access credentials on the dark web, sent victims samples of their own data as proof and threatened to sell the data to other criminal groups if no ransom was paid.

The investigation covers about 1,000 suspected attacks worldwide. About 500 have so far been identified as successful, and investigators said those figures may change as they review the seized evidence. Spanish police put the number of victims at more than 280. Europol said in a statement quoted by Reuters that the group obtained substantial ransom payments.

Hamburg police also said investigators found that the group used artificial intelligence to build and operate its infrastructure and identify potential victims, but the statement gave no further detail. Because no more detail was provided, it is not clear from the public statements what tools were used or how important they were to the attacks.

Although agencies describe KillSec as a ransomware group, much of the conduct described publicly centers on data theft and extortion. Ransomware usually refers to malware that encrypts files and demands payment, while extortion can also involve stealing data and threatening to publish it. Rapid7 reported in 2025 that KillSec had been active since at least 2021, began as a hacktivist group and moved into ransomware in October 2023. Rapid7 said KillSec's ransomware, KillSecurity 2.0 and 3.0, was designed to encrypt files, but that some incidents relied only on stolen data for pressure. In June 2024, according to Rapid7, the group began offering ransomware to affiliates through a ransomware-as-a-service model.

For website owners and IT teams, the technical lesson is direct: exposed cloud storage, weak access points and unpatched software can become the first step in a data theft and extortion case. Backups are important, but they do not stop stolen customer files, internal documents or credentials from being used as leverage. Systems that store private data need regular patching, strict account access, careful cloud settings and checks for old or forgotten entry points.