THREATNOIR
Subscribe
Back to advisories

Police dismantle KillSec ransomware gang allegedly led by 16-year-old

Law enforcement dismantled KillSec ransomware gang following Operation KillSwitch, seizing infrastructure and arresting three members including a 16-year-old administrator. The gang executed over 500 attacks since 2024, using stolen data for extortion and reportedly integrating AI into their operations. Victims across all sectors may face continued extortion attempts and secondary data sales from already-compromised systems.

HIGHAdvisoryOct 02, 2026
Action required
Search your environment for KillSec IOCs (leaked domains, IP addresses, file hashes from operation reports). Cross-reference against network logs, email gateways, and endpoint telemetry for any historical beaconing or C2 communication. Prioritize organizations that may have been targeted or breached.
Affected products
EuropolEurojustBitdefenderGroup-IB
Linked articles
Source links