Loading story…
European law-enforcement agencies disrupted the KillSec ransomware and data-extortion group in Operation KillSwitch on 30 September, taking control of its leak site, domains, and five central servers. Authorities provisionally arrested three suspects and searched eight locations across four countries, securing at least 110 TB of stolen data, evidence, and assets. A 16-year-old is suspected of being the group’s main administrator and operator, while a suspected developer had recently turned 18.
Active since 2024, KillSec is suspected of launching nearly 1,000 attacks worldwide, with investigators having identified about 500 successful compromises. The group allegedly exploited software vulnerabilities and poorly secured access points—particularly cloud-storage environments—to exfiltrate data and extort victims through threats of public disclosure rather than relying solely on encryption. Investigators continue to identify affected organizations and accomplices and trace cryptocurrency proceeds.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
International law enforcement conducted Operation KillSwitch against KillSec, provisionally arresting three suspects and searching eight properties in Greece, Romania, Spain, and the United Kingdom. Authorities took control of the group’s leak site and domains, brought five central servers under police control, and secured at least 110 TB of stolen data.
Authorities in multiple countries began investigations into attacks attributed to KillSec.
KillSec became active as a ransomware and data-extortion group, allegedly compromising organizations through software vulnerabilities and poorly secured access points, particularly cloud storage.
During the KillSec investigation, authorities identified a 16-year-old as the group’s suspected administrator and main operator, along with suspected members allegedly acting as a developer, negotiator, and affiliate. Investigators continued examining seized evidence and tracing alleged cryptocurrency proceeds.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourceeurojust.europa.eu
Open sourcemalware.news
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International law enforcement agencies said **Operation Cronos** disrupted LockBit, the ransomware-as-a-service group long described as the world’s most prolific ransomware operation. Authorities seized infrastructure, took control of LockBit’s leak site and platform, exposed affiliates, delivered decryption keys to victims, and publicly revealed that the group sometimes retained stolen victim data and failed to provide working decryptors. According to the FBI, LockBit operated from 2020 to 2024, hit more than **2,500 organizations** in at least **120 countries**, and collected more than **$500 million** in ransom payments; several members have since been arrested or charged, while alleged leader **Dmitry Yuryevich Khoroshev** remains indicted, sanctioned, and at large.
Jul 28, 2026
International law enforcement agencies have intensified efforts to disrupt the infrastructure of prominent malware and ransomware operations. Europol, as part of Operation Endgame, targeted the servers supporting the Rhadamanthys information stealer, resulting in a sudden loss of access for its operators and a halt in observed activity since late October 2025. Rhadamanthys, a C++-based stealer-as-a-service, had been widely distributed through phishing campaigns and malicious ads, with its latest version released in October 2025. The operation's impact on the long-term viability of Rhadamanthys remains to be seen, but the immediate effect has been a significant reduction in its activity. In parallel, law enforcement agencies across the US and Europe have made notable arrests and infrastructure takedowns targeting ransomware groups. The UK’s National Crime Agency apprehended a suspect linked to a ransomware attack that disrupted multiple European airports, while US authorities filed charges against the administrator of several notorious ransomware gangs and seized assets from a Zeppelin ransomware distributor. Additionally, a coordinated international operation dismantled the infrastructure of the BlackSuit ransomware group, further demonstrating the global commitment to combating cybercrime. These actions collectively signal a robust and ongoing crackdown on cybercriminal operations by international authorities.
Jul 12, 2026
The FBI and international partners disrupted the infrastructure of **ALPHV/BlackCat**, a major ransomware-as-a-service operation linked to more than 1,000 victims and attacks across U.S. critical infrastructure sectors including healthcare, manufacturing, government, emergency services, schools, and defense-related organizations. U.S. authorities seized multiple ALPHV-operated sites and said an FBI-developed decryptor was provided to more than 500 victims worldwide, helping dozens restore systems and avoid an estimated **$68 million** in ransom payments. Officials described ALPHV as one of the world’s most prolific ransomware groups, and said the investigation remained active even though no arrests were announced. Months later, ALPHV appeared to collapse amid allegations that its operators staged an **exit scam** after receiving a reported **$22 million** ransom tied to the Change Healthcare attack. A new seizure notice posted on the group’s leak site was disavowed by the U.S. Justice Department, Europol, and the U.K. National Crime Agency, while researchers said it reused elements from the legitimate law-enforcement takedown page. Reporting and affiliate claims indicated the group’s leaders kept the payment, cut off an affiliate, and then announced on a cybercrime forum that they were shutting down and planned to sell the malware source code, reinforcing assessments that affiliates may migrate and the operators could reappear under a new brand.
Jun 29, 2026