A TEENAGER has been arrested in Alicante on suspicion of running an international ransomware gang linked to around 1,000 cyberattacks worldwide.
The Guardia Civil’s cybercrime unit (UCO) and the Mossos d’Esquadra arrested the 16-year-old boy, a Romanian national, over his alleged role as the group’s administrator.
Officers searched a home and an office inside a hotel in Alicante province. A woman is also under investigation for her alleged connection to the gang, also know as KillSec.
READ MORE: Personal data warning after hackers steal user information from Renfe and Adif websites
He was one of three people detained on September 30, in an operation led by police and prosecutors in Hamburg. The other two suspects, both in their twenties, were arrested in the UK and Romania.
The Spanish side of the case, codenamed Operation Rotoma, began with a request from the FBI’s office in San Juan, Puerto Rico.
UCO officers identified the Alicante suspect using nothing more than a profile image. Puerto Rico has asked for the man held in the UK to be extradited.
The Mossos opened their own case after an attack in early 2025 on the Catalan public body infraestructures.cat.
The hackers allegedly stole sensitive data and tried to extort it, causing damage estimated at close to €1 million. The two forces then set up a joint investigation team.
Writing on X, the Catalan force said nine countries took part: Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the UK and the United States.
Investigators say about 500 of the gang’s attacks succeeded, hitting more than 280 victims. Some of them reportedly paid around €500,000 in cryptocurrency.
KillSec broke into organisations through software vulnerabilities and badly secured access points, particularly in cloud storage. It then listed victims on a dark web leak site and threatened to publish their data unless they paid.
Police took over the leak site and secured at least 110 terabytes of data. Five central servers were also seized, and visitors to the gang’s domains now see a police seizure notice.
In Alicante, officers seized computers, mobile phones, cryptocurrency wallets and encryption tools.
Investigators have identified four roles within the gang: administrator, developer, negotiator and affiliate. The suspected developer turned 18 in August and was a minor when some of the attacks took place.
KillSec reportedly started out as a hacktivist group and moved into ransomware in late 2023. Investigators are now tracing the gang’s cryptocurrency profits, which could lead to more victims and suspects.
Click here to read more Crime & Law News from The Olive Press.
