Police dismantle KillSec ransomware network led by 16-year-old after 1,000 cyberattacks

Coordinated raids and infrastructure seizure

On 30 September 2026, law enforcement agencies across Europe and the United States executed Operation KillSwitch to dismantle the infrastructure of the ransomware collective KillSec. Officers searched eight properties across Greece, Romania, Spain, and the United Kingdom, arresting three suspects. Authorities seized five servers used to store and exfiltrate stolen victim files, including the group's central host server. Law enforcement took control of the group's darknet leak portal and secured at least 110 terabytes of data against unauthorized access. Investigators also confiscated computing devices, digital repositories, and financial assets during the searches.

Teenage leadership and technical roles

Investigators identified a 16-year-old suspect as the alleged primary administrator and orchestrator of KillSec. Another key suspect, identified as a developer for the cybercrime outfit, turned 18 years old in August. Police also uncovered individuals performing specialized functions within the syndicate, including a dedicated negotiator and an affiliate distribution partner. The group utilized artificial intelligence tools to construct and maintain its ransomware infrastructure and to scan networks to identify potential corporate victims.

Scale of cyberattacks and extortion methods

KillSec focused on exploiting vulnerabilities in corporate software and insecure cloud storage repositories to extract proprietary records. The perpetrators used a double extortion model, copying sensitive files, locking systems through encryption, and threatening public publication on their leak portal if victims refused to pay ransoms. The group received substantial sums from targeted entities in several instances. Investigators estimate that KillSec carried out approximately 1,000 cyberattacks globally since 2024, with roughly 500 deemed successful. In Germany, authorities documented at least 70 cases, including 18 tied to entities in Hamburg. Swiss prosecutors opened proceedings in July 2025 regarding attacks on domestic businesses that occurred between October 2023 and June 2025. Law enforcement officials noted that case numbers may shift as forensic analysis continues.

International cross-border cooperation

The operation was directed by the Hamburg State Criminal Police Office (LKA) and the Hamburg Public Prosecutor's Office, which initiated the inquiry in early 2025 after the earliest local cases were detected. Cross-border operational coordination involved more than a dozen European agencies and two United States authorities, including the Federal Bureau of Investigation, with organizational support from Europol and Eurojust. Participating national bodies spanned Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom. The Swiss Federal Office of Police (Fedpol) and the Office of the Attorney General of Switzerland participated directly in the coordinated actions.

Hamburg Interior Senator Andy Grote commented on the role of local investigators in the cross-border operation.

Following "Operation Medusa" against sexualised violence against sedated persons, the international strike against the "KillSec" group is already the second international operation within a few months in which the Hamburg LKA played a decisive role.

Authorities confirmed that legal proceedings remain ongoing and emphasized that the presumption of innocence applies to all suspects.