Glossary term
Law enforcement takedown
A law enforcement takedown is a coordinated action in which police and prosecutors shut down or seize the servers, domains or other infrastructure that criminals use.
Read more
Ransomware group profile
KillSec
Also known as KillSec ransomware
KillSec is a ransomware and data extortion group that Europol says has been active since around 2024.
- Disrupted
In short
KillSec is a ransomware and data extortion group that Europol says has been active since around 2024. On 30 September 2026 law enforcement took control of its leak site, securing at least 110 terabytes of data, in an operation led by German authorities.
- StatusDisruptedas reported
- Other Names1names in public reportsKillSec ransomware
- Entry Routes2ways inSoftware vulnerabilities · Poorly secured access points
- Defences4first steps listedPatch exposed software · Watch for large data copies
Overview
KillSec is a cybercrime group that steals data from organisations and threatens to publish it unless a ransom is paid. The main source for this page is a Europol news release dated 1 October 2026. It says KillSec has been active since around 2024 and is linked to around 1,000 suspected attacks worldwide.
On 30 September 2026 law enforcement took control of the group’s leak site and secured at least 110 terabytes of data against further unauthorised access. This is a law enforcement takedown carried out as Operation KillSwitch. German authorities led the investigation, with the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor’s Office in charge.
Europol says three suspects were provisionally arrested and eight properties were searched in Greece, Romania, Spain and the United Kingdom. Five central servers were brought under police control and the group’s domains now redirect to a law enforcement seizure notice. Investigators are tracing the group’s proceeds, including cryptocurrency.
A note on sources: Europol is the only official body we could open that describes KillSec. We found no CISA advisory and no MITRE ATT&CK entry for it, so this page makes no claim about its tools or technique IDs. People named in the investigation are suspects and have not been convicted of anything we know of; this page does not name them.
Also known as
- KillSec ransomware
Timeline
-
Around 2024
Europol says KillSec has been active since around 2024.
-
Early 2025
Authorities in several countries begin investigating attacks attributed to KillSec.
-
30 Sep 2026
Law enforcement takes control of the KillSec leak site, securing at least 110 terabytes of data. Three provisional arrests and eight searches were carried out in four countries during the operation.
-
1 Oct 2026
Europol publishes its news release on Operation KillSwitch.
How they get in
-
01
Software vulnerabilities
Europol says KillSec exploited software vulnerabilities to get into organisations' systems. The release does not name a product or a CVE.
-
02
Poorly secured access points
Europol says the group also used poorly secured access points, particularly to cloud storage. Members then copied internal data to infrastructure under their control.
How they extort
Data theft and threats, per Europol: victims were named on the group's dark web leak site and threatened with publication of their data unless they paid. Where a victim did not pay, the stolen files could be made available for free download. In some cases the group obtained substantial ransom payments.
How to defend
-
Patch exposed software
Europol says KillSec got in through software vulnerabilities, so fix flaws in internet-facing systems first.
-
Secure access points and cloud storage
Europol says poorly secured access points, particularly to cloud storage, were used. Review who and what can reach your storage and remote access, and close what is not needed.
-
Watch for large data copies
The group copied internal data to its own infrastructure before extortion. Monitoring for unusual outbound transfers helps you spot theft early.
-
Keep offline backups
CISA says many ransomware variants try to find and delete or encrypt accessible backups, and advises maintaining offline, encrypted backups of critical data.
Questions
What is KillSec?
KillSec is a ransomware and data extortion group. Europol says it has been active since around 2024 and used a dark web leak site to threaten organisations with publication of stolen files unless they paid.
What happened to the KillSec leak site?
On 30 September 2026 law enforcement took control of it and secured at least 110 terabytes of data. Europol says the group's domains now redirect to a law enforcement seizure notice.
What is Operation KillSwitch?
It is the international investigation behind the action, led by German authorities and supported by Europol, Eurojust and authorities from ten countries. It covers around 1,000 suspected attacks worldwide.
How many attacks were successful?
Europol says around 500 of the suspected attacks have so far been identified as successful, and that this figure may change as investigators examine the seized evidence.
Who is behind KillSec?
Europol says investigators identified suspects in the roles of administrator, developer, negotiator and affiliate, and that the suspected main operator is a teenager. They are suspects. This page does not name them.
Is KillSec still active?
Its leak site and five central servers are under police control, but Europol says enquiries into other possible members are continuing. Check your national cyber agency for current activity.
In our research
- Law enforcement takedown Glossary term
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 45 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.