Police dismantle ransomware gang allegedly run by a 16-year-old

An international operation, dubbed Operation KillSwitch, successfully dismantled a ransomware group called KillSec, with suspected leader a 16-year-old Romanian national, Europol reported. The coordinated raid involved three arrests and searches of eight locations in Spain, Greece, Romania, and the United Kingdom. Police also seized control of five critical servers and KillSec's dark-web leak site, safeguarding over 110 terabytes of stolen data from unauthorized access.

This investigation is probing around 1,000 suspected cyberattacks worldwide linked to KillSec. Authorities have confirmed approximately 500 attacks as successful, though this number may change as more evidence is scrutinized. The 16-year-old, a Romanian national, was identified as KillSec's suspected main operator and administrator during the operation in Alicante, Spain.

The organization, which emerged around 2024, exploited software vulnerabilities and exposed access points to infiltrate organizations' systems and pilfer sensitive data. Victims were then blackmailed on KillSec's dark-web leak site, threatened with the public release of their stolen files unless they paid a ransom. In some instances, the group reportedly garnered significant payments.

The investigation also revealed that KillSec harnessed artificial intelligence to bolster its ransomware infrastructure and pinpoint prospective targets, amplifying concerns over the infiltration of AI tools into cybercrime.