# Operation KillSwitch: International Takedown of the KillSec Data-Theft Extortion Ransomware Group

> On 30 September 2026 an international law enforcement action led by the Hamburg State Criminal Police Office and Hamburg Public Prosecutor's Office, coordinated by Europol and Eurojust with Bitdefender and Group-IB support, took over the KillSec leak site and seized five central servers. KillSec, active since about 2024, stole data by exploiting software vulnerabilities and poorly secured access points (particularly cloud storage) and threatened to publish it unless victims paid.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-07T12:58:01.045Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2829
- **ID:** TL-2026-2829
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** KillSec
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation KillSwitch targeted the KillSec (also tracked as Kill Security / KillSec3) data-theft extortion and ransomware-as-a-service group. The action day was 30 September 2026 and was announced by Europol and Eurojust on 1 October 2026. Ten countries took part: Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom and the United States. Law enforcement took control of the group's leak site, which was redirected to a seizure notice, secured at least 110 TB of data against further unauthorised access, gained control of associated domains and seized five central servers. Three suspects were provisionally arrested and eight property searches were carried out in four countries (Spain, Greece, the United Kingdom and Romania per press reporting).

Investigators identified a 16-year-old as the suspected administrator and main operator. A suspected developer turned 18 in August 2026 and was a minor during part of the alleged offending; a suspected negotiator and an affiliate were also identified, and inquiries into further members are ongoing. CyberScoop reports the negotiator as a Dutch national arrested in the UK and facing extradition to the US. National investigations began in early 2025. Investigators linked KillSec to about 1,000 suspected attacks worldwide, of which about 500 were identified as successful (subject to change). Close to 300 victims were posted on the leak site: 126 in 2025 and 25 in 2026, with the last known posting on 18 September 2026.

Per Bitdefender and Europol, KillSec exploited software vulnerabilities and poorly secured access points, particularly cloud storage, copied sensitive data and threatened to publish it unless victims paid. The group reportedly used AI to build and maintain its infrastructure and to identify potential victims. Earlier open reporting describes KillSec emerging in late 2023 as a self-styled Anonymous offshoot doing DDoS and defacement against government sites (India, Poland, Brazil) before becoming a RaaS operation by mid-2024 with affiliate dashboards and custom Windows and VMware ESXi lockers (AES-256-CBC with RSA-2048 key wrapping), exfiltrating with MEGAsync and Rclone, terminating Veeam/Acronis/Sophos processes and deleting shadow copies and event logs. These secondary-source details were not confirmed by the law enforcement announcement. No CVEs or technical IOCs (IPs, domains, hashes) were published by the sources. Defender guidance from Bitdefender: patch internet-facing software first, because that is where the scanning happens, then audit cloud storage access, with attention to buckets and shares nobody owns. The takedown reduces immediate risk, but affiliates and stolen data (110 TB secured, other copies may exist) remain a residual concern.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1530 Data from Cloud Storage
- T1567.002 Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1566 Phishing
- T1133 External Remote Services
- T1110 Brute Force
- T1021.001 Remote Services
- T1486 Data Encrypted for Impact

## Sources

- [Bitdefender Supported Operation KillSwitch: What the KillSec Takedown Changes for Defenders](https://www.bitdefender.com/en-gb/blog/businessinsights/bitdefender-supported-operation-killswitch-what-killsec-takedown-means-defenders)
- [Teenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site (Europol)](https://www.europol.europa.eu/media-press/newsroom/news/teenager-suspected-of-leading-killsec-ransomware-group-law-enforcement-seizes-servers-and-leak-site)
- [Authorities seize KillSec extortion group infrastructure, arrest 3 alleged members (CyberScoop)](https://cyberscoop.com/killsec-ransomware-group-arrests-operation-killswitch/)
- [Operation KillSwitch: Police Dismantle KillSec Ransomware Group (Security Affairs)](https://securityaffairs.com/200200/cyber-crime/operation-killswitch-police-dismantle-killsec-ransomware-group.html)
- [KillSec Ransomware Group Dismantled, 16-Year-Old Suspected Admin Arrested (Hackread)](https://hackread.com/killsec-ransomware-group-dismantled-admin-arrested/)
- [KillSec: From Hacktivist Roots to Ransomware Franchise](https://reddogsecurity.substack.com/p/killsec-from-hacktivist-roots-to)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2829