Berlin: An international law-enforcement operation has disrupted the KillSec ransomware network following an investigation into around 1,000 suspected cyberattacks worldwide.

The coordinated operation, known as Operation KillSwitch, resulted in three provisional arrests, eight property searches across four European countries and the seizure of servers and other digital infrastructure linked to the alleged cybercrime network.

Suspected Teenage Operator Identified

Investigators identified a 16-year-old as the suspected main operator and administrator of KillSec.

Authorities say the group has been active since around 2024 and targeted organisations by exploiting software vulnerabilities and poorly secured access points, including weaknesses associated with cloud storage.

The investigation also identified suspects believed to have performed different roles, including administration, development, negotiation and affiliate operations.

Hundreds of Attacks Investigated

Law-enforcement agencies have linked KillSec to approximately 1,000 suspected attacks worldwide.

Around 500 of those attacks have so far been identified as successful, although authorities said the figure could change as investigators analyse evidence seized during the operation.

The alleged victims included organisations from sectors such as healthcare, financial services and government.

Stolen Data Used for Extortion

Investigators said KillSec obtained sensitive information from compromised systems and transferred the data to infrastructure controlled by the group.

Victims were then allegedly threatened with publication of their stolen information unless ransom demands were paid.

The group’s leak site was used to identify victims and threaten the release of stolen files. Authorities took control of the site on September 30, securing at least 110 terabytes of stolen data from further unauthorised access.

Five Servers Seized

During the investigation, authorities brought five central servers under law-enforcement control.

The infrastructure included systems used to manage the group’s activities and store information allegedly stolen from victims. Several domains operated by KillSec were also seized and redirected to law-enforcement notices.

Investigators are examining the seized devices and data for evidence that could identify additional victims, attacks and people involved in the network.

Nine Countries Cooperated

The operation involved authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States, with Europol and Eurojust supporting international coordination.

The cross-border investigation also involved cooperation from cybersecurity companies that provided intelligence and technical assistance.

Financial Investigation Continues

Authorities are also tracing suspected criminal proceeds, including cryptocurrency assets.

The financial investigation could provide additional information about the organisation’s structure and identify other individuals connected to the alleged ransomware operation.

One separate suspect arrested in the United Kingdom, Fouad Eltibrizi, faces charges in the United States relating to alleged unauthorised computer access and extortion. The U.S. case remains an allegation, and defendants are presumed innocent unless proven guilty in court.

International Cybercrime Response

The KillSec operation demonstrates the increasingly international nature of ransomware investigations.

Cybercriminal groups can operate infrastructure, attackers and financial networks across multiple jurisdictions, making cooperation between national police agencies and prosecutors important for identifying suspects and securing digital evidence.

Investigators will now continue analysing the seized infrastructure and data as the wider inquiry into KillSec’s alleged activities proceeds.