An 18-year-old living in Athens is suspected of working as a developer for KillSec, the ransomware group linked to almost 1,000 cyberattacks worldwide, Greek police announced on October 2.
The Greek Police identified him as a foreign national. His home was searched during Operation KillSwitch on September 30, an international action against the group coordinated by Eurojust with Europol support. Investigators have identified approximately 500 successful attacks. Across the operation, authorities reported three arrests and eight searches in Greece, Romania, Spain and the United Kingdom.
Devices seized in Athens
Greek cybercrime investigators located the suspect after receiving information from German, Romanian and US authorities. German and Romanian representatives attended the search, which was conducted under a prosecutor’s order.
Officers seized a laptop, four mobile phones, two hard drives, two USB storage devices and a notebook containing handwritten notes. One USB device contained backups of messaging-app conversations.
The suspect was a minor when some of the alleged offenses occurred. The announcement does not specify his nationality or announce an arrest in Athens.
How KillSec used stolen data to demand ransom
According to Eurojust, KillSec has operated since 2024. Its members exploited inadequately protected access points, particularly those associated with cloud storage, to enter organizations’ systems.
They copied sensitive files onto infrastructure they controlled, then threatened to release the information unless victims paid. Samples of stolen data were sent to demonstrate that the attackers possessed it. Files belonging to victims who refused to pay were made available for free download, Eurojust said.
The agency said some victims made substantial ransom payments. Suspects concealed their identities with online aliases and communicated through encrypted messaging services.
Investigators identified roles including administrator, developer, negotiator and affiliate. A 16-year-old is suspected of being the main operator. The allegations remain under investigation.
Police secure the leak site and servers
The operation brought KillSec’s leak site under police control and secured at least 110 terabytes of stolen data against further unauthorized access. Five central servers used to manage the group’s activities and store victims’ files were also brought under police control.
Cybersecurity company Group-IB, which supported the investigation, described KillSec as a ransomware-as-a-service operation. Affiliates used its platform to conduct attacks in return for a share of ransom proceeds. The company said the German-led investigation was supported by intelligence about the group’s infrastructure and operations.
Eurojust’s account of the international investigation lists nine participating countries: Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States.
Separate incidents, including a Russian-linked campaign affecting Greek military email accounts and an attack that disrupted a UK power generator, show the wide range of threats that companies and governments alike face lately, but neither incident is identified as part of the KillSec investigation.
See all the latest news from Greece and the world at Greekreporter.com. Contact our newsroom to report an update or send your story, photos and videos. Follow GR on Google News and subscribe here to our daily email!
