Spanish Police Dismantle KillSec Ransomware Group in International Operation
Spanish authorities have arrested a 16-year-old Romanian national suspected of leading the KillSec ransomware group, following a coordinated international crackdown. The operation, led by Catalan police and the Civil Guard’s cybercrime unit, resulted in the seizure of the group’s leak site and infrastructure, along with raids on eight properties across Greece, Romania, the U.K., and Spain. Two additional arrests were made.
Active since 2024, KillSec executed around 1,000 attacks, with at least half succeeding. The group exploited cloud storage vulnerabilities to infiltrate systems, steal sensitive data, and extort victims via its leak site. Targets included healthcare providers, government agencies, and financial firms.
Investigations began in early 2025 after a series of attacks, with authorities identifying four suspected members including a developer who turned 18 in August. The operation received support from Europol’s European Cybercrime Centre, cybersecurity firms BitDefender and Group-IB, and law enforcement in 10 countries, including the U.S., U.K., and Switzerland.
KillSec operated one of the most affordable ransomware-as-a-service (RaaS) platforms, offering a Tor-based control panel with chat functionality and custom tools, enabling low-skilled attackers to launch campaigns. The takedown disrupts a major player in the ransomware ecosystem, though authorities continue to investigate remaining suspects.
Source: https://therecord.media/killsec-ransomware-raas-arrests-europe
HackNotice cybersecurity rating report: https://www.rankiteo.com/company/hacknotice
"id": "HAC1790871925",
"linkid": "hacknotice",
"type": "Ransomware",
"date": "10/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Healthcare',
'type': 'Healthcare providers'},
{'industry': 'Government',
'type': 'Government agencies'},
{'industry': 'Finance', 'type': 'Financial firms'}],
'attack_vector': 'Cloud storage vulnerabilities',
'data_breach': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Sensitive data'},
'date_detected': '2025-early',
'description': 'Spanish authorities have arrested a 16-year-old Romanian '
'national suspected of leading the KillSec ransomware group, '
'following a coordinated international crackdown. The '
'operation resulted in the seizure of the group’s leak site '
'and infrastructure, along with raids on eight properties '
'across Greece, Romania, the U.K., and Spain. KillSec executed '
'around 1,000 attacks, exploiting cloud storage '
'vulnerabilities to infiltrate systems, steal sensitive data, '
'and extort victims. The group targeted healthcare providers, '
'government agencies, and financial firms.',
'impact': {'data_compromised': 'Sensitive data'},
'initial_access_broker': {'entry_point': 'Cloud storage vulnerabilities'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Cloud storage vulnerabilities, '
'low-skilled attackers enabled by '
'RaaS platform'},
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'ransomware_strain': 'KillSec'},
'references': [{'source': 'Cyber incident description'}],
'response': {'containment_measures': 'Seizure of leak site and '
'infrastructure, raids on properties',
'law_enforcement_notified': 'Yes',
'third_party_assistance': 'Europol’s European Cybercrime Centre, '
'BitDefender, Group-IB'},
'threat_actor': 'KillSec ransomware group',
'title': 'Spanish Police Dismantle KillSec Ransomware Group in International '
'Operation',
'type': 'Ransomware',
'vulnerability_exploited': 'Cloud storage vulnerabilities'}