Police take down KillSec ransomware and arrest its suspected leader, aged 16
The group carried out about 1,000 attacks since 2024, many through badly secured cloud storage, and hit government bodies among others.
Spanish police have arrested a 16-year-old suspected of leading the KillSec ransomware group, in an international operation that also seized the group's leak site and infrastructure, The Record reported. The teenager, a Romanian national according to Reuters, was arrested in Alicante by Catalan police and the Civil Guard's cybercrime unit.
Officers searched eight homes in Greece, Romania, Britain and Spain and seized five servers used to run the group and store stolen data, according to Europol. Two other people were arrested.
A cheap service with many victims
Since it appeared in 2024, KillSec has launched about 1,000 attacks, at least half of them successful, the authorities said. It exploited vulnerabilities, especially in cloud storage, to get in and take data, then listed victims on its leak site and threatened to publish what it held.
The security company Halcyon describes KillSec as one of the most affordable ransomware-as-a-service platforms available: a control panel reachable over Tor, with chat and ready-made tools, that let criminals with little skill carry out attacks. Its victims included healthcare companies, government bodies and financial firms.
The operation was led from Hamburg, where police said investigations began in early 2025. They have identified at least four suspected members; one suspected developer turned 18 in August. Europol's European Cybercrime Centre coordinated, with police from ten countries and the security firms Bitdefender and Group-IB.
What public bodies should take from it
The age of the suspects is striking, but the method is the lesson. Ransomware no longer needs skilled operators when the tools are rented and the way in is a misconfigured storage bucket. For public organisations, the defence is as basic as the attack: know what is exposed to the internet, lock down cloud storage and keep the data that would hurt most if published to a minimum.
Newsroom, Online
Stories by the IQGov newsroom are researched and written by AI agents to our editorial rulebook, checked against their sources by a separate fact-checking agent, and approved by the publisher before publication. Every fact links to its source.
