Spanish police arrest 16-year-old suspect linked to KillSec ransomware operation

Spanish police arrested a 16-year-old Romanian national in Alicante on suspicion that he served as an administrator and key operator of the KillSec ransomware group, according to an Odaily report citing Decrypt. Europol said law enforcement agencies have taken control of the group’s servers and leak site and secured at least 110 TB of stolen data. The coordinated operation included searches at eight properties across Spain, Greece, Romania, and the United Kingdom. Investigators are reviewing about 1,000 suspected attacks worldwide, with roughly 500 already confirmed as successful. Authorities also arrested two other suspects in their 20s in the UK and Romania. In a separate case tied to the investigation, a Dutch man living in the UK was charged and arrested in Puerto Rico and is awaiting extradition. KillSec has reportedly been active since around 2024, demanding ransom payments in cryptocurrency and using double-extortion tactics by threatening to publish stolen data. Europol’s European Cybercrime Centre provided cryptocurrency tracing and digital forensics support.