Arrest of 18-year-old in Athens for participation in hacker group KillSec
Greek Police arrested an 18-year-old foreign national in Athens as part of the international operation "KillSwitch" against the ransomware group KillSec.
18-year-old developer arrested in Athens for KillSec ransomware attacks
Greek Police proceeded with the arrest of an 18-year-old foreign national in Athens, who is alleged to have participated as a programmer (developer) in the criminal group "KillSec", according to ot.gr. The operation is part of the international action "KillSwitch", which took place on Wednesday, 30 September 2026.
The Cyber Crime Prosecution Directorate received information from the authorities of Germany, Romania and the USA regarding the 18-year-old, who resides in Greece. Following a prosecutorial order, a search was conducted at his residence in Athens, in the presence of representatives from the German and Romanian authorities as members of the Joint Investigation Team (JIT).
In total, three arrests and eight searches of residences in Greece, Romania, Spain and the United Kingdom were carried out on the day of action. The operation involved authorities from nine countries — Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the USA — under the coordination of Eurojust and with the support of Europol.
The authorities seized the website used for publishing stolen files by the group and secured at least 110 terabytes of data from further unauthorised access. As part of the international investigation, five central servers were placed under police control, while domain names used by the group were also seized.
Nearly 1,000 cyber attacks worldwide
The group "KillSec" had been active since at least 2024 and is alleged to be responsible for nearly 1,000 cyber attacks worldwide, of which approximately 500 have already been confirmed as successful. Members of the group obtained unauthorised access to information systems, extracted data and demanded ransoms, threatening to publish the stolen files in the event of non-payment.
In the course of the investigation, suspects with different roles were identified: administrator, programmer, negotiator and affiliate. According to evidence gathered so far, a 16-year-old is alleged to have held the role of main operator of the group, whilst the 18-year-old identified in Greece was a minor at the time of committing part of the investigated acts. To conceal their identities, members of the group used online pseudonyms and encrypted communication services.
Europol provided analytical and operational support, including the tracing of cryptocurrency transactions and the examination of digital evidence. Eurojust assumed responsibility for coordinating judicial cooperation and provided real-time support for the parallel actions of the involved authorities.
Investigations are continuing to examine the seized digital data, trace criminal proceeds and establish any further cyber attacks, victims and persons involved.
Source: Google News GR — Crime (el)