CyberNew CyberNew
Ransomware & Malware The Record 2 weeks ago

Police disrupt KillSec ransomware, arrest suspected teenage leader

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Data & Identity Stores
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"An investigator confiscates devices as part of Operation Killswitch. Image: Europol Police disrupt KillSec ransomware, arrest suspected teenage leader Spanish police announced the arrest Thursday of the 16-year-old suspected leader of the KillSec ransomware group as part of an international operation that also saw the seizure of the group’s leak site and infrastructure. Catalan authorities,..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Operation Killswitch
An investigator confiscates devices as part of Operation Killswitch. Image: Europol

Police disrupt KillSec ransomware, arrest suspected teenage leader

Spanish police announced the arrest Thursday of the 16-year-old suspected leader of the KillSec ransomware group as part of an international operation that also saw the seizure of the group’s leak site and infrastructure. 

Catalan authorities, alongside the Civil Guard’s cybercrime unit, arrested the minor in the town of Alicante. According to Reuters, he is a Romanian national. 

Police raided eight houses as part of the operation, in Greece, Romania, Britain and Spain, and seized five servers allegedly used to manage the group’s activities and store stolen data. Two other arrests were made, police said.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →