On October 2, PANews reported that, according to Decrypt, Spanish police arrested a 16-year-old Romanian suspect in Alicante. The suspect is believed to be an administrator and the main operator of the KillSec ransomware group. Europol said that law enforcement agencies in multiple European locations also seized the group’s servers and leak websites, preserving at least 110TB of stolen data. Two more people were arrested in the UK and Romania, respectively.

The September 30 operation was led by the Hamburg State Criminal Police Office and the city’s prosecutor’s office. Investigators examined about 1,000 suspected attacks worldwide, with about 500 already confirmed as successful. KillSec has been active since around 2024 and uses double extortion; ransoms are often demanded in cryptocurrency. Investigators also found that the group uses AI to build and maintain its ransomware infrastructure. Currently, five central servers have been taken under police control, and investigators are tracing criminal proceeds, including cryptocurrency.