KillSec

KillSec is a ransomware and data-extortion group active since about 2024. Investigators link it to around 1,000 suspected attacks, about 500 of them successful, and say it got in through software flaws and weakly protected cloud storage. The group used a leak site to publish victims' stolen files and pressure them into paying.

The group lost that site on 30 September 2026. Operation KillSwitch, a raid by ten countries under Hamburg's State Criminal Police Office, backed by Europol and Eurojust, also took five of KillSec's core servers and at least 110 terabytes of its stolen haul. Suspects' homes were searched in Greece, Romania, Spain and the UK, eight in all, and police made three provisional arrests. Europol says the suspected administrator and main operator is a 16-year-old.

For KillSec, the raid hit infrastructure and people at once. A May 2026 Europol action, Operation Saffron, had taken 33 servers from First VPN, a service ransomware crews relied on, but named no arrest.