Spanish police have arrested a 16-year-old suspected of being a key operator in the KillSec ransomware group in the province of Alicante as part of a major international operation. The group is believed to have carried out nearly 1,000 cyberattacks globally since 2024, targeting organizations by encrypting their data and demanding payments in cryptocurrency. Investigators identified four roles within the group, with the teenager reportedly serving as the chief administrator. Two men in their early 20s were also arrested in the United Kingdom and Romania, while an 18-year-old in France was placed in provisional custody for breaching a tax agency’s systems, with a 16-year-old suspected accomplice under investigation. The FBI office in San Juan, Puerto Rico, collaborated with Spanish gendarmes, the Guardia Civil, to track members of KillSec based in Spain. Using a simple profile photo, Spanish police located the 16-year-old suspect in Alicante. In Catalonia, regional police launched an investigation after a cyberattack on a local organization in early 2025, which caused nearly one million euros in damages and was suspected to be the work of KillSec. Europol and Eurojust coordinated the efforts of law enforcement across several European countries, with support from cybersecurity firms Bitdefender and Group-IB. Europol confirmed that the authorities have "successfully dismantled a ransomware group." During searches in Alicante, gendarmes seized computer equipment and cryptocurrency wallets, uncovering transactions linked to ransoms paid by victims. In Hamburg, police led the "KillSwitch" operation, taking offline five servers, including the group's main server and several machines storing stolen data, and sealing 110 terabytes of data. A seizure notice has now been displayed on five domain names associated with KillSec. Prosecutors in Puerto Rico requested the extradition of a suspect arrested in the United Kingdom, according to a Europol spokesperson. In Romania, a 24-year-old man was arrested and searched from four residences in Bucharest and Vaslui county. On October 1, Romanian prosecutors asked a Bucharest court to place him in provisional custody for 30 days, though he is presumed innocent. The alleged developer of KillSec, who turned 18 in August, was a minor during some of the group's attacks. Investigators identified him without making an arrest. In June 2024, KillSec began offering its ransomware tools to external hackers, allowing them to rent the group's infrastructure and launch attacks. Members exploited software vulnerabilities and insecure access points, particularly cloud storage, to infiltrate systems and copy sensitive data. Victims were threatened with leaks of their data on the dark web unless they paid ransoms. If victims failed to pay, stolen files could be released publicly. Romanian prosecutors noted that group members purchased access credentials on the dark web, using stolen data as proof of their attacks and threatening to sell them to other criminals if payments were not made. Authorities are examining nearly 1,000 suspected attacks, with about 500 confirmed successful ones. Spanish police have identified more than 280 victims, while Hamburg police have traced at least 70 attacks in Germany, 18 of which were linked to the city itself. Europol stated that the group "obtained significant ransoms." German police revealed that KillSec used artificial intelligence to build its infrastructure and identify potential victims, though no further details were provided. In its 2026 report on cybercrime, Europol warned about the growing threat of AI tools capable of conducting entire criminal operations autonomously. Investigators are currently analyzing seized devices and cryptocurrency transactions to trace more victims and suspects. For now, the three arrests in Hamburg are provisional, and police continue searching for other members of the KillSec group.