18-year-old Romanian in Athens linked to KillSec hackers – seizures and three arrests
The Cyber Crime Prosecution is investigating an 18-year-old of Romanian origin in Athens for a role as a programmer in the KillSec group. A laptop, four mobile phones and a USB drive containing copies of conversations were found at his home.
Investigation at 18-year-old's home in Agios Panteleimon into international cyber-attack group KillSec
An 18-year-old of Romanian origin residing in Athens is under investigation at the Cyber Crime Prosecution, as he is suspected of holding a technical role as a programmer in the international cyber-attack group KillSec. According to Newsit.gr, some of the acts being investigated are believed to have been committed whilst the young man was still a minor.
The case is part of a broader international operation coordinated by Europol and Eurojust. The Cyber Crime Prosecution Directorate received information from the authorities of Germany, Romania and the United States regarding the suspected involvement of the young man. This was followed by online meetings coordinated by Europol and a meeting at Eurojust headquarters, during which it was decided to establish a Joint Investigation Team with the participation of Greece, Romania and Germany.
Seizure of digital evidence
On 30 September, during a coordinated operation with a prosecutorial warrant, a search was carried out at his residence in Agios Panteleimon. Representatives of German and Romanian authorities were present.
From the search, a laptop, four mobile phones, two hard drives, two USB sticks and a diary with handwritten notes were seized. Particular interest is attached to one of the USB drives: according to ELAS (the Hellenic Police), it contained backup copies of conversations from a messaging application. The handwritten notes in the diary are also under examination.
All digital material will be examined in order to determine whether there is evidence linking the 18-year-old to specific actions, individuals or infrastructure attributed to KillSec.
More than 1,000 cyber-attacks attributed to KillSec
KillSec has long been at the centre of international investigations. The group is attributed with more than 1,000 cyber-attacks or attempted attacks against companies and organisations. Its modus operandi includes breaches of information systems, access to corporate networks and theft of sensitive data.
The victims are believed to have subsequently received extortion demands for payment of ransoms, usually in cryptocurrencies, with the threat of publishing the stolen data in the event of refusal.
Three arrests and 110 terabytes of data across four countries
The results of the international operation are extensive: a total of three arrests were made and eight searches carried out in Spain, Greece, the United Kingdom and Romania. The authorities secured at least 110 terabytes of stolen data, whilst five servers believed to have been used for storing victim data were seized, as well as internet domains attributed to the group.
Europol provided operational and analytical support, including for tracing cryptocurrency transactions and examining digital evidence. Eurojust assumed the coordination of judicial cooperation between the involved countries.
The investigation is ongoing, with Greek authorities examining the seized digital evidence in order to determine the extent of the 18-year-old's involvement in activities attributed to KillSec.
Source: Newsit.gr