Three Arrested in Operation Targeting KillSec Ransomware Group

Authorities in a coordinated international operation on September 30 made three provisional arrests, searched eight properties and seized control of the KillSec ransomware group’s leak site and five servers. Europol identified a 16-year-old as the group’s suspected main operator. The allegations remain under investigation, and the arrests are provisional. Police carried out searches in Spain, Greece, Romania and the United Kingdom. The operation involved authorities in several countries, with German police leading the investigation alongside Europol and Eurojust. The group’s dark web site now displays a law-enforcement seizure notice. The FBI said at least 110 terabytes of data were secured against further unauthorized access. Investigators have identified people suspected of serving as an administrator, developer, negotiator and affiliate. Europol described the 16-year-old as the suspected administrator and main operator. A second suspected member, identified as a developer, turned 18 in August 2026 and was a minor during some of the alleged offenses. Authorities have not publicly specified the suspected roles of the men arrested in the United Kingdom and Romania.