A 16-year-old boy is accused of controlling more than a thousand ransomware extortion attacks worldwide 🦖🚨
⚖️ ⏰ 消息群里第一时间说
Spanish police in Alicante have arrested a 16-year-old Romanian teenager, concluding that he is the administrator and main operator of the ransomware group KillSec. This is a coordinated European operation codenamed KillSwitch, in which at least 110TB of stolen data was seized.
Let’s talk scale—these numbers are terrifying. Police believe the group was involved in roughly 1,000 suspected attacks worldwide, with around 500 confirmed to have succeeded. The operation searched eight properties in Spain, Greece, Romania, and the UK, seized control of five core servers, and also took over its dark-web leak site.
They have been active since around 2024, targeting software vulnerabilities and cloud storage with weak defenses. After stealing data, they carry out “double extortion”: first encrypt your servers, then threaten to publish the data if you don’t have backups. In Puerto Rico, a company that didn’t pay saw about 180GB of patient data posted directly online.
The key is in this line: the ransom is usually demanded to be paid in cryptocurrency.⚖️
Besides the 16-year-old already in custody, there are two suspects in their twenties—one in the UK and one in Romania. A 25-year-old “negotiator” in Manchester, UK was arrested, and local authorities have confirmed 28 victim companies. Another suspect, a Dutch national using the alias Archduke, was indicted by a federal grand jury in Puerto Rico on September 16. He faces up to 10 years in prison and possible extradition.
Even more worrying, investigators found that the group also used AI to build and maintain its ransomware infrastructure, and to screen potential victims.
My take: many people think cryptocurrency equals anonymity, but this time Europol’s European Cybercrime Centre specifically deployed a team to trace encrypted funds. The ledger on-chain is public by nature, and with the identity verification thresholds at exchanges, once money moves to and from marked addresses, it can become evidence for investigators. 💰 The “anonymity” that truly protects hackers may not be protecting them at all.
For ordinary users, the takeaway from stories like this is straightforward: don’t leave important data only in a cloud account without strong verification. When facing ransomware, backups and access management matter more than anything.
What do you think—did cryptocurrency help hackers, or help the police? Let’s discuss in the comments.
Click the profile icon to watch the livestream
Every day, I’ll help you track cryptocurrency security hotspots—not just what happened, but also the logic and opportunities behind it 👀🚀
⚖️ ⏰ 消息群里第一时间说
Spanish police in Alicante have arrested a 16-year-old Romanian teenager, concluding that he is the administrator and main operator of the ransomware group KillSec. This is a coordinated European operation codenamed KillSwitch, in which at least 110TB of stolen data was seized.
Let’s talk scale—these numbers are terrifying. Police believe the group was involved in roughly 1,000 suspected attacks worldwide, with around 500 confirmed to have succeeded. The operation searched eight properties in Spain, Greece, Romania, and the UK, seized control of five core servers, and also took over its dark-web leak site.
They have been active since around 2024, targeting software vulnerabilities and cloud storage with weak defenses. After stealing data, they carry out “double extortion”: first encrypt your servers, then threaten to publish the data if you don’t have backups. In Puerto Rico, a company that didn’t pay saw about 180GB of patient data posted directly online.
The key is in this line: the ransom is usually demanded to be paid in cryptocurrency.⚖️
Besides the 16-year-old already in custody, there are two suspects in their twenties—one in the UK and one in Romania. A 25-year-old “negotiator” in Manchester, UK was arrested, and local authorities have confirmed 28 victim companies. Another suspect, a Dutch national using the alias Archduke, was indicted by a federal grand jury in Puerto Rico on September 16. He faces up to 10 years in prison and possible extradition.
Even more worrying, investigators found that the group also used AI to build and maintain its ransomware infrastructure, and to screen potential victims.
My take: many people think cryptocurrency equals anonymity, but this time Europol’s European Cybercrime Centre specifically deployed a team to trace encrypted funds. The ledger on-chain is public by nature, and with the identity verification thresholds at exchanges, once money moves to and from marked addresses, it can become evidence for investigators. 💰 The “anonymity” that truly protects hackers may not be protecting them at all.
For ordinary users, the takeaway from stories like this is straightforward: don’t leave important data only in a cloud account without strong verification. When facing ransomware, backups and access management matter more than anything.
What do you think—did cryptocurrency help hackers, or help the police? Let’s discuss in the comments.
Click the profile icon to watch the livestream
Every day, I’ll help you track cryptocurrency security hotspots—not just what happened, but also the logic and opportunities behind it 👀🚀
