Reported by 25 outlets
KillSec ransomware group disrupted in international law enforcement operation
Why this score
- Breadth
- 2.00 / 2.0 · 25 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.03 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
An international law enforcement operation dismantled a network used by the KillSec ransomware group. The Swiss Federal Police announced the action on 30 September 2026, with coordination across Bern and other partners. KillSec operates as Ransomware-as-a-Service, with over 250 documented compromises, a $250 affiliate fee, and infection vectors through misconfigured AWS S3 buckets and CVE-2025-31161. Watch whether affiliates regroup under a new brand and how downstream healthcare victims respond.
Timeline
-
original reporting
🍾 Cybercrime: Computer network used by ransomware group dismantled in coordinated international operation ⬇️ Bern, 01.10.2026 — On 30 Septem
www.fedpol.admin.ch · 12d ago · October 1st, 2026
🍾 Cybercrime: Computer network used by ransomware group dismantled in coordinated international operation ⬇️ Bern, 01.10.2026 — On 30 Septem
via Mastodon https://www.fedpol.admin.ch/en/newnsb/cBOoSTI5a7sc
-
update from resecurity.com
KillSec ransomware attacking healthcare institutions in Brazil
resecurity.com · 399d ago · September 10th, 2025
Resecurity published analysis on 10 September 2025 describing a KillSec ransomware attack on MedicSolution, a Brazilian healthcare software vendor. The breach exposed over 34 GB of data containing 94,818 files, including unredacted patient pictures, lab results, and records related to minors. The attackers exploited exposed AWS cloud buckets rather than penetrating networks, affecting downstream healthcare facilities including Vita Exame and Centro Diagnostico Toledo.
-
update from halcyon.ai
KillSec threat profile (Halcyon)
halcyon.ai · 335d ago · November 13th, 2025
Halcyon updated its KillSec threat profile on 13 November 2025, documenting the group as a Ransomware-as-a-Service operation that formalized its platform in June 2024. The profile records over 250 documented compromises, a $250 entry fee with 88% affiliate retention, and primary infection vectors exploiting misconfigured AWS S3 buckets and CVE-2025-31161. It notes the group reached over 250 victims with geographic concentration in India, USA, and Latin America, and had active operations through November 2025.
-
update from osintsights.com
Law Enforcement Disrupts KillSec Ransomware Gang Led by Teenager In a major breakthrough, international authorities have successfully disrup
osintsights.com · 12d ago · October 1st, 2026
Law Enforcement Disrupts KillSec Ransomware Gang Led by Teenager In a major breakthrough, international authorities have successfully disrup
via Mastodon https://osintsights.com/law-enforcement-disrupts-killsec-ransomware-gang-led-by-teenager?utm_source=mastodon&utm_medium=social
-
update from www.europol.europa.eu
New. Still a child. When did childhood become a criminal business? Europol: Teenager suspected of leading KillSec ransomware group as law en
www.europol.europa.eu · 12d ago · October 1st, 2026
New. Still a child. When did childhood become a criminal business? Europol: Teenager suspected of leading KillSec ransomware group as law en
via Mastodon https://www.europol.europa.eu/media-press/newsroom/news/teenager-suspected-of-leading-killsec-ransomware-group-law-enforcement-seizes-servers-and-leak-site
-
update from cyber.netsecops.io
📰 Europol Dismantles KillSec Ransomware; Teenager Suspected Leader Europol dismantles KillSec ransomware infrastructure in Operation KillSwi
cyber.netsecops.io · 12d ago · October 1st, 2026
📰 Europol Dismantles KillSec Ransomware; Teenager Suspected Leader Europol dismantles KillSec ransomware infrastructure in Operation KillSwi
via Mastodon https://cyber.netsecops.io/articles/europol-dismantles-killsec-ransomware-group-teen-leader-suspected/?utm_source=mastodon&utm_medium=social&utm_campaign=daily
-
mentioned by thehackernews.com
🛑 Police arrested a 16-year-old suspected of running KillSec. Authorities took over the # ransomware group’s leak site and shut down five se
thehackernews.com · 12d ago · October 1st, 2026
-
mentioned by osintsights.com
Police Disrupt KillSec Ransomware Group, Arrest Suspects Worldwide In a major cybercrime crackdown, international law enforcement agencies j
osintsights.com · 12d ago · October 1st, 2026
-
update from therecord.media
Spanish police announced the arrest Thursday of the 16-year-old suspected leader of the KillSec ransomware group # cybersecurity https:// th
therecord.media · 12d ago · October 1st, 2026
Spanish police announced the arrest Thursday of the 16-year-old suspected leader of the KillSec ransomware group # cybersecurity https:// th
via Mastodon https://therecord.media/killsec-ransomware-raas-arrests-europe
-
update from securityaffairs.com
Operation KillSwitch: Police Dismantle KillSec Ransomware Group
securityaffairs.com · 12d ago · October 1st, 2026
Operation # KillSwitch : Police Dismantle # KillSec # Ransomware Group https:// securityaffairs.com/200200/cyb er-crime/operation-killswit
via Mastodon https://securityaffairs.com/200200/cyber-crime/operation-killswitch-police-dismantle-killsec-ransomware-group.html
-
mentioned by www.bleepingcomputer.com
🤖 Operation KillSwitch: Spanish police arrested a 16-year-old suspected of running the KillSec ransomware group. Three arrests on Sept 30; l
www.bleepingcomputer.com · 12d ago · October 1st, 2026
-
update from www.heise.de
Ransomware group Killsec busted: teenager named as main suspect. Hamburg law enforcement led "Operation Killswitch", resulting in three arrests.
www.heise.de · 12d ago · October 1st, 2026
Ransomware group Killsec busted: teenager named as main suspect. Hamburg law enforcement led "Operation Killswitch", resulting in three arrests.
-
update from donporque.com
How did the 16-year-old accused of leading KillSec fall in Alicante? # KillSec # Hacker # Cybersecurity # Cyberattack # Ransomware # Alicante
donporque.com · 12d ago · October 1st, 2026
How did the 16-year-old accused of leading KillSec fall in Alicante? # KillSec # Hacker # Cybersecurity # Cyberattack # Ransomware # Alicante
via Mastodon https://donporque.com/hacker-de-16-anos-detenido-en-alicante-por-killsec/
-
update from www.securityweek.com
https://www. securityweek.com/police-shut-d own-killsec-ransomware-identify-alleged-teen-leader # Ransomware # CyberSecurity # LawEnforcemen
www.securityweek.com · 12d ago · October 2nd, 2026
securityweek.com/police-shut-d own-killsec-ransomware-identify-alleged-teen-leader # Ransomware # CyberSecurity # LawEnforcemen
via Mastodon https://www.securityweek.com/police-shut-down-killsec-ransomware-identify-alleged-teen-leader
-
update from cyberworldops.eu
German-led Operation KillSwitch seized KillSec's leak site and extortion servers on Sept 30 with support from 9 other countries. Investigato
cyberworldops.eu · 12d ago · October 2nd, 2026
German-led Operation KillSwitch seized KillSec's leak site and extortion servers on Sept 30 with support from 9 other countries.
-
update from gbhackers.com
16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation
gbhackers.com · 11d ago · October 2nd, 2026
This coordinated action, announced on October 1, involved agencies from nine countries and was supported by Eurojust and Europol. KillSec Ransomware Leader Arrested KillSec, which has been […] The post 16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by osintsights.com
Authorities Disrupt KillSec Extortion Group in Global Operation In a major breakthrough, law enforcement agencies from 10 countries joined f
osintsights.com · 11d ago · October 2nd, 2026
-
mentioned by osintsights.com
Law Enforcement Disrupts KillSec Ransomware Group with Global Arrests In a major breakthrough, global law enforcement agencies have joined f
osintsights.com · 11d ago · October 2nd, 2026
-
update from www.darkreading.com
International authorities have shut down a major digital extortion group linked to hundreds of attacks. This serves as a reminder to keep yo
www.darkreading.com · 11d ago · October 2nd, 2026
International authorities have shut down a major digital extortion group linked to hundreds of attacks. This serves as a reminder to keep yo
via Mastodon https://www.darkreading.com/cyberattacks-data-breaches/killsec-ransomware-mastermind-16-year-old
-
update from en.hacks.gr
Authorities in Spain, the UK and Romania have arrested three people over alleged links to KillSec. The group is accused of stealing organiza
en.hacks.gr · 11d ago · October 2nd, 2026
Authorities in Spain, the UK and Romania have arrested three people over alleged links to KillSec. The group is accused of stealing organiza
via Mastodon https://en.hacks.gr/oi-arches-piran-ton-elegcho-tis-istoselidas-tis-killsec-kai-stamatisan-pente-systimata-tis/
-
mentioned by cyber.netsecops.io
📰 Europol Dismantles KillSec Ransomware; Teenager Suspected Leader Europol dismantles KillSec ransomware infrastructure in Operation KillSwi
cyber.netsecops.io · 11d ago · October 2nd, 2026
-
mentioned by tugatech.com.pt
International Operation Ends KillSec Ransomware Group, Identifies 16-Year-Old Leader
tugatech.com.pt · 11d ago · October 2nd, 2026
-
mentioned by www.theregister.com
Teen suspected of running KillSec ransomware group as cops seize servers, arrest three Operation KillSwitch takes over leak site holding at
www.theregister.com · 11d ago · October 2nd, 2026
-
update from cyberveille.ch
KillSec ransomware group infrastructure dismantled in international operation
cyberveille.ch · 11d ago · October 2nd, 2026
On October 1, 2026, the Federal Office of Police (fedpol) announced the action carried out on September 30, 2026. via Mastodon https://cyberveille.ch/posts/2026-10-02-demantelement-de-l-infrastructure-du-groupe-ransomware-killsec-lors-d-une-operation-internationale/
-
mentioned by cyberveille.ch
KillSec dismantled: a 16-year-old suspected of leading the ransomware group, per official Europol statement
cyberveille.ch · 11d ago · October 2nd, 2026
-
update from decrypt.co
Spanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group A second suspect faces extradition to Puerto Rico, while Inves
decrypt.co · 11d ago · October 2nd, 2026
Spanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group A second suspect faces extradition to Puerto Rico, while Inves
via Mastodon https://decrypt.co/379913/spanish-police-arrest-16-year-old-accused-of-running-killsec-ransomware-group
-
mentioned by www.bleepingcomputer.com
# Police dismantle # KillSec # ransomware gang allegedly led by 16-year-old https://www. bleepingcomputer.com/news/secu rity/police-dismantl
www.bleepingcomputer.com · 11d ago · October 2nd, 2026
-
mentioned by newisty.com
Spanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group Spanish authorities arrested a teenager accused of leading the
newisty.com · 10d ago · October 3rd, 2026
-
update from www.bleepingcomputer.com
Europol says the suspected main operator of the KillSec ransomware crew is sixteen years old. Operation KillSwitch dismantled it on 30 Septe
www.bleepingcomputer.com · 10d ago · October 3rd, 2026
Europol says the suspected main operator of the KillSec ransomware crew is sixteen years old.
-
mentioned by korben.info
KillSec dismantled: suspected main administrator arrested at 16
korben.info · 8d ago · October 5th, 2026
-
update from go.darkwebsonar.io
Threat Pulse: KillSec takedown Police seized KillSec's leak site on 30 September. That does not recall what the group already posted. Our re
go.darkwebsonar.io · 8d ago · October 5th, 2026
That does not recall what the group already posted. Our re
via Mastodon https://go.darkwebsonar.io/killsec-mastodon
-
update from insicurezzadigitale.com
Operation KillSwitch: Europol dismantles KillSec, the ransomware gang led by a 16-year-old
insicurezzadigitale.com · 8d ago · October 5th, 2026
A blitz across four European countries coordinated by Europol took down the group. https://insicurezzadigitale.com/operazione-killswitch-europol-smantella-killsec-la-gang-ransomware-guidata-da-un-sedicenne/
via Mastodon https://insicurezzadigitale.com/operazione-killswitch-europol-smantella-killsec-la-gang-ransomware-guidata-da-un-sedicenne/
-
mentioned by insicurezzadigitale.com
Operation KillSwitch: Europol dismantles KillSec, the ransomware gang led by a 16-year-old
insicurezzadigitale.com · 8d ago · October 5th, 2026
-
mentioned by www.darkreading.com
KillSec ransomware mastermind is 16 years old, DarkReading reports
www.darkreading.com · 8d ago · October 5th, 2026
-
update from go.darkwebsonar.io
Threat Pulse: KillSec takedown A client can be in the KillSec story without ever being a target. Healthcare software and IT service provider
go.darkwebsonar.io · 5d ago · October 8th, 2026
Threat Pulse: KillSec takedown A client can be in the KillSec story without ever being a target.