An international law enforcement operation has dismantled the infrastructure of the KillSec ransomware group, resulting in the seizure of five servers holding at least 110 terabytes of stolen victim data.
The action was coordinated by Eurojust with support from Europol and involved authorities from nine countries: Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom, and the United States. Eight searches were conducted in Spain, Greece, the United Kingdom, and Romania, leading to the recovery of evidence and assets. In addition to the servers, investigators took control of domains operated by the group, including the leak site used to publish victim data.
Three people were arrested during the operation, including a 16-year-old identified as the group's main administrator and operator. KillSec has been active since 2024 and is linked to nearly one thousand ransomware incidents globally. The group employs a double-extortion model in which data is exfiltrated before encryption, with the threat of publication used to increase pressure on victims to pay ransoms.
Among the targets were technology environments in the healthcare sector, where system unavailability can directly affect patient care. The 110 terabytes of seized data represent material extracted from victims and stored on the servers to support the second stage of extortion. Europol provided analytical reports on the group's activity, facilitated coordination with private sector partners, and tracked cryptocurrency movements linked to the operation.
