A significant blow has been dealt to the KillSec ransomware group as international law enforcement agencies, led by Germany, have dismantled their operations. Europol reports that a 16-year-old believed to be the mastermind behind KillSec has been identified, along with several other suspects, following an operation dubbed 'Operation KillSwitch'. The investigation, which included police actions in Greece, Romania, Spain, and the UK, resulted in three provisional arrests and searches of eight residences.
Authorities have taken control of KillSec's dark web leak site and secured approximately 110 terabytes of data, which was allegedly stolen from numerous victims. The site was being used to extort organizations by threatening to release their sensitive data unless a ransom was paid. Additionally, law enforcement has gained access to five key servers used by KillSec for managing their operations and holding the data they had compromised.
KillSec has been active since around 2024, targeting organizations by exploiting software vulnerabilities and weak entry points, particularly in cloud storage systems. It is currently known to have carried out around 500 successful attacks. Prior to its shutdown, the group's leak website listed approximately 450 victims.
The operation to dismantle KillSec involved contributions from law enforcement agencies in Belgium, Finland, the Netherlands, Switzerland, the UK, and the US, and was supported by cybersecurity firms Bitdefender and Group-IB. Investigators continue to analyze devices and data seized during the operation, with the goal of identifying more victims and potentially uncovering additional suspects.
