The Hacker News disclosed that Spanish police have arrested a 16-year-old suspected of leading the KillSec ransomware group, which is accused of stealing data and threatening to publish it unless ransoms were paid. The arrest was part of a coordinated international operation that also saw the takedown of the group's leak site.
The operation, led by Hamburg police in Germany and involving law enforcement agencies from Spain, the U.K., and Romania, resulted in three arrests. The 16-year-old was detained in Alicante, Spain, while two others, aged in their 20s, were arrested in the U.K. and Romania. KillSec targeted organizations by exploiting software vulnerabilities and insecure cloud storage, stealing sensitive data and extorting victims through a dark web leak site. Investigators identified suspects in four roles: administrator, developer, negotiator, and affiliate. The group is believed to have conducted approximately 1,000 suspected attacks globally, with around 500 confirmed successful. Authorities also seized over 110 terabytes of data and shut down five servers, including KillSec's main server. The investigation, which began in 2025, is ongoing, with authorities examining seized devices and tracing cryptocurrency transactions to identify further victims and suspects.
Source: The Hacker News
