Police seize KillSec servers and data in Operation KillSwitch takedown

Seizures, arrests and new evidence are expected to expose more victims and accomplices linked to the KillSec ransomware group.

European and US authorities have disrupted the KillSec ransomware group in an operation called “Operation KillSwitch,” seizing its dark‑web leak site, core servers, and at least 110 TB of stolen data. The coordinated takedown on September 30 involved law‑enforcement agencies from ten countries, with Europol, Eurojust, Bitdefender, and Group‑IB providing support. Investigators say KillSec has been active since about 2024, exploiting software vulnerabilities and exposed edge systems to steal corporate data, then extorting victims via its Tor-based leak portal; roughly 500 attacks are believed to have succeeded so far, including at least 70 against German organizations. Police provisionally arrested three people and searched eight locations across Greece, Romania, Spain, and the UK, identifying suspects believed to have served as the group’s administrator, developer, negotiator, and an affiliate. Authorities report that the alleged main operator is just 16 years old, that the group received significant ransom payments, and that its members relied on AI tools to build and run their infrastructure and select targets, with further victims and accomplices expected to emerge from the seized evidence.