Police dismantle ransomware gang allegedly run by a 16-year-old

European authorities have dismantled key infrastructure belonging to an international ransomware group whose suspected main operator is just 16, Europol said.

The coordinated operation against the KillSec group involved three provisional arrests and searches of eight properties across Spain, Greece, Romania and the United Kingdom.

Police also took control of five central servers and KillSec’s dark-web leak site, securing at least 110 terabytes of stolen data against further unauthorised access, according to Europol.

The international investigation, dubbed Operation KillSwitch, is examining around 1,000 suspected cyberattacks worldwide linked to the group. Authorities have so far identified around 500 of them as successful, although Europol said that figure could change as investigators examine seized evidence.

Teenager identified as suspected main operator

Investigators identified a 16-year-old as KillSec’s suspected administrator and main operator.

Spanish police said the teenager, a Romanian national, was arrested in Alicante. Reuters reported that the operation is part of a Europe-wide investigation into KillSec’s activities.

Another suspected developer turned 18 in August and was still a minor when some of the alleged offences took place.

Investigators have also identified people suspected of acting as a negotiator and an affiliate, while inquiries into other possible members are continuing.

KillSec has operated since around 2024 as a ransomware-as-a-service group.

According to Europol, attackers exploited software vulnerabilities and poorly secured access points, particularly cloud storage, to gain access to organisations’ systems and steal sensitive information.

Victims were then named on KillSec’s dark-web leak site and threatened with having their stolen files published unless they paid a ransom. In some cases, investigators say the group obtained substantial payments.

AI used to find targets

Investigators also found that KillSec used artificial intelligence to help build and maintain its ransomware infrastructure and identify potential victims, adding another dimension to concerns over criminals adopting AI tools for cyberattacks.

Authorities from several European countries and the United States participated in the investigation, with Europol and Eurojust helping coordinate the operation.

Investigators are now examining seized devices and data and tracing criminal proceeds, including cryptocurrency, as they attempt to identify additional attacks, victims and people involved.

The suspects have not been convicted, and the investigation remains ongoing.