12OCT

Police seize KillSec ransomware leak site

2 min read

10:55UTC

A Hamburg-led operation took the KillSec ransomware leak site, seized five core servers and secured at least 110 terabytes of stolen victim data on 30 September.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Operation KillSwitch took KillSec's leak site and servers and made three provisional arrests.

Police in an operation led by Hamburg's State Criminal Police Office (LKA Hamburg) took control of the KillSec ransomware leak site on 30 September⁠¹. The gang used the site to post victims' stolen files and pressure them into paying. Officers secured at least 110 terabytes of stolen victim data and seized five core servers.

Operation KillSwitch ran with Europol and Eurojust, the EU's police and judicial cooperation agencies, and ten countries took part⁠². Europol says the suspected administrator and main operator of KillSec is a 16-year-old. Separately, officers searched eight homes in Greece, Romania, Spain and the UK and made three provisional arrests.

Investigators link KillSec, active since about 2024, to around 1,000 suspected attacks, about 500 of them successful. The gang got in through software flaws and weakly protected cloud storage. Europol-backed action against the First VPN service in May pulled 33 servers and questioned its administrator in Ukraine.

Deep Analysis

In plain English

KillSec was a ransomware gang. Ransomware criminals break into organisations, steal their files, lock their systems and demand money, threatening to publish the files on a 'leak site' if they are not paid. On 30 September police from 10 countries, led by the state police in Hamburg, Germany, with help from Europol and Eurojust, the EU's police and prosecutor agencies, took over KillSec's leak site and seized its main servers. That stops the gang publishing more stolen files. Police made three arrests and searched homes in four countries, including the UK.

Deep Analysis

Root Causes

Ransomware-as-a-service sells ready-made encryption tools, leak sites and negotiation support, so running an extortion crew no longer needs deep technical skill. That widens the pool of people who can operate one.

Cloud storage left open or weakly protected gives such crews an entry route that needs no exploit at all. Investigators list it alongside software flaws as KillSec's way in.

The leak site is the crew's leverage: it turns stolen data into public pressure on victims to pay. Seizing it removes the threat for current victims even before any prosecution.

What could happen next?

Consequence
Victims listed on KillSec's site lose the immediate threat of publication while police hold the servers.
Risk
Affiliates who used KillSec's tools can move to another ransomware brand and keep the same entry methods.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In February 2024 Operation Cronos, led by Britain's National Crime Agency, took over LockBit's leak site and made arrests in Poland and Ukraine. LockBit put up a new site within about a week, but affiliates' trust in the brand collapsed and its claims fell through 2024.

Counter-parallel: In January 2023 the FBI shut down Hive after quietly infiltrating it for seven months and handing victims decryption keys, with no arrests announced. The brand disappeared, yet its code resurfaced later that year in Hunters International.

The seizure removes a live extortion threat over about 450 listed victims, which lowers the value of any ransom still being negotiated. Companies that had refused to pay lose nothing; those weighing payment now have less reason to.

Bitdefender and Group-IB supported the operation, a reminder that private threat-intelligence firms now supply much of the technical work behind European takedowns.

Consensus view: Europol framed the operation around the victims, stressing that police secured at least 110 terabytes of stolen data against further release. Taking the leak site, the servers and suspects in one action removes the extortion lever and the infrastructure together, a broader result than Europol's May takedown of the First VPN service.

Counter-view: The Hamburg State Criminal Police Office's own figures cut the other way on scale: at least 70 German victims and 18 with a Hamburg link, out of about 1,000 suspected attacks worldwide. KillSec got in through software flaws and weakly protected cloud storage, entry routes that any affiliate can reuse under a new name.

Key tension: Whether copies of the 110 terabytes exist outside the seized servers, which decides if victims are actually protected.

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

Europol· 12 Oct 2026

Read original →

Causes and effects

Caused by

Saffron raid takes down First VPN

Europol's May First VPN raid seized servers without arrests; KillSwitch took servers, the leak site and suspects.

Occurred 21 May 2026

Read story →

This Event

Police seize KillSec ransomware leak site

Police took the leak site, the servers and suspects in one operation, rather than infrastructure alone.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.