Authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom executed a synchronized takedown on September 30 targeting the KillSec ransomware group. The operation, designated "Operation KillSwitch" and led by German law enforcement, resulted in the seizure of the gang's data leak site and infrastructure, three provisional arrests, and the identification of a 16-year-old as the suspected main operator. Europol and Eurojust supported the investigation alongside cybersecurity firms Bitdefender and Group-IB.
The investigation, which began in 2025, identified multiple members of the criminal organization including an administrator, developer, negotiator, and affiliate. According to Europol, the suspected primary operator is only 16 years old. A second suspect identified as a developer turned 18 in August 2026 and was still a minor when certain alleged crimes took place.
Hamburg Police examined the group's server infrastructure and disabled five servers in total, including KillSec's primary server and multiple machines allegedly used to house stolen information. The gang's dark web data leak site, previously accessible at https://ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id.onion/, now displays a law enforcement seizure notice. "The domain, servers and all associated data linked to Operation KillSwitch have been taken into control by State Criminal Police Office of Hamburg and international law enforcement agencies," the banner states.
https://player.vimeo.com/video/1232032220
During the operation, investigators recovered at least 110 terabytes of stolen data to prevent further unauthorized access. Eight properties were searched across Greece, Romania, Spain, and the United Kingdom, resulting in three provisional arrests. Authorities have determined that approximately 500 of KillSec's attacks succeeded, though investigators cautioned this figure may change as evidence analysis continues. At least 70 suspected attacks targeted German organizations, with 18 cases connected to Hamburg specifically.
KillSec emerged around 2024 and operated by exploiting software vulnerabilities and inadequately secured edge devices to infiltrate corporate networks and exfiltrate sensitive data. The group then leveraged the stolen information for extortion schemes through its dark web leak site, threatening to publish data unless victims paid ransoms. Europol noted that KillSec obtained "substantial" ransom payments through these extortion campaigns.
The investigation revealed that group members employed artificial intelligence technology to develop and operate their ransomware infrastructure and identify prospective targets. Law enforcement is currently analyzing seized computers, servers, and related materials while working to locate KillSec's alleged criminal proceeds, including digital currency holdings. Officials believe the recovered evidence may uncover additional victims, attacks, and individuals connected to the ransomware operation.