Three people, including a 16-year-old boy, have been arrested for alleged involvement in the KillSec ransomware operation.

Law enforcement bodies from several countries, led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor’s Office, raided eight properties in Spain, Greece, the UK, and Romania. Digital infrastructure, evidence, and criminal assets were seized.

They also took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorized access. Five central servers used to manage the group’s activities and store data taken from victims were brought under police control, and KillSec’s domains were redirected to a law enforcement seizure notice.

The unnamed 16-year-old, a Romanian national, is believed to have been the leading figure behind KillSec. Meanwhile, other suspects are believed to hold different roles within the group, including an administrator, a developer – still a minor when some of the offences were committed – a negotiator, and an affiliate.

“It’s concerning to know a child was the mastermind behind it all. This is something the cyber security industry and governments cannot dismiss, because it clearly highlights we are not doing enough to deter young people from cyber crime,” said Daniel Wilcock, threat intelligence analyst at Talion Cyber Security.

“These children, who clearly possess expert technical skills, need to be educated that there are other ways they can use their talents to make money.”

Another alleged member of the group, Dutch national Fouad Eltibrizi, has meanwhile been charged in the US with conspiracy to intentionally access a computer without authorization for financial gain, intentionally causing damage without authorization to a protected computer, and intentionally transmitting a threat to obtain information from a protected computer without authorization with the intent to extort.

KillSec, a financially motivated ransomware-as-a-service (RaaS) group has been linked to around 1,000 suspected attacks worldwide. So far, around 500 of the suspected attacks have been identified as successful, a figure that may change as investigators examine the evidence seized, the authorities warned.

The group was first identified in 2024 when the group recruited affiliates via a dark web leak site and public Telegram channels to carry out attacks using its platform in exchange for a percentage of each ransom.

Last year, Group-IB’s High-Tech Crime Trends Report 2026 ranked KillSec among the ten most active ransomware groups in Asia-Pacific, Latin America, and the Middle East. Financial services and healthcare were the most targeted sectors, while the victim list also included government bodies and a major insurer, investment firms, and a consumer app with millions of users.

Investigators are now examining the seized devices and data and tracing the group’s criminal proceeds, including cryptocurrency. The evidence, said Europol, may help identify further victims, attacks, and people involved.

“Closing the gaps these groups exploit is essential, but it does not end an operation like this,” said Dmitry Volkov, CEO of Group-IB, which was involved in the operation.

“Servers can be replaced in weeks; the people who build the platform and approve every attack cannot. Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end.”