Threat Intelligence

Teen Suspected of Running KillSec Ransomware Gang Arrested in Spain

The Hacker News · 2 Oct 2026

Key Takeaway This case shows ransomware gangs can be dismantled through international cooperation, so businesses should report extortion attempts to police rather than negotiating directly with attackers.

Police in Spain have arrested a 16-year-old suspected of being the main administrator behind KillSec, a ransomware group accused of stealing data from organisations and threatening to publish it online unless victims paid up. The arrest was part of a coordinated operation on 30 September led by police and prosecutors in Hamburg, Germany, which also resulted in authorities seizing control of KillSec's leak site and servers.

Two other suspects, both in their twenties, were arrested in the UK and Romania as part of the same operation. Spanish, German, Romanian and US authorities, including the FBI and prosecutors in Puerto Rico, all took part, and an extradition request has been filed for the UK suspect. In Romania, a 24-year-old is under investigation for forming an organised criminal group and related computer crimes, with prosecutors seeking 30 days of custody.

Investigators believe KillSec operated with distinct roles, including an administrator, developer, negotiator and affiliate partners who used the group's ransomware tools to carry out attacks. A suspected developer, who turned 18 in August, has been identified but not yet arrested. All suspects are presumed innocent, and police described the arrests as provisional.

ransomware KillSec law enforcement cybercrime data extortion

Primary source eurojust.europa.eu ->

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.