> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe - URL: https://f4n6.co.uk/security-feed/risky-bulletin-authorities-dismantle-killsec-group-arrest-members-across-europe/ - Published: 2026-10-02T08:27:55.000Z - Updated: 2026-10-02T08:27:55.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-31161, KillSec ## 1\. Executive summary A Europol- and Eurojust-coordinated operation across nine countries dismantled the KillSec ransomware-as-a-service operation on 30 September 2026, arresting three people and seizing the group's servers and dark web leak site. The suspected main administrator is a 16-year-old Romanian national arrested in Alicante, Spain; a second suspect was arrested in Romania and a third, Dutch national Fouad Eltibrizi, in the UK, where the US has filed an extradition request over a March 2025 attack on a Puerto Rico company. Europol attributes more than 1,000 attacks to KillSec and its affiliates since the platform launched in June 2024, at least 500 of them successful, with no regional or sector preference, and the group has been linked to exploitation of CVE-2025-31161 in CrushFTP, which carries a CVSS of 9.8, sits in CISA KEV with a 2025-04-07 addition date, and has an EPSS score of 100%. The bottom-line risk to EMEA financial services is residual rather than novel: the arrests remove the RaaS brand and its leak site, but the affiliates, the unpatched-server access paths and the stolen data remain, and any client that paid KillSec or is listed on its leak site should assume the data is still held by affiliates who were not arrested. Attribution of the group's activity to a named actor is unconfirmed: the reference data holds no MITRE ATT&CK profile for "KillSec". ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A client that suffered a KillSec intrusion and paid a ransom, or is listed on the seized leak site, has an incident whose classification and reporting status must be settled now that the operator is dismantled | The takedown does not close an open incident. Reporting timelines and the major-incident classification already run from detection, not from the arrest. | | DORA Art. 28: ICT third-party risk, general principles | KillSec operated as a Ransomware-as-a-Service platform with affiliates, so any client exposure runs through an affiliate relationship the client cannot see | Third-party risk assessment must cover the affiliate model, not just the named group, because the arrested individuals are a subset of the affiliate pool. | | NIS2 Art. 23: incident reporting obligations | Same trigger as above for entities in scope of NIS2 rather than DORA | Reporting obligations are unaffected by the law-enforcement action; the incident still has to be reported on its own timeline. | No other article in the regulatory reference is engaged by this item. The takedown itself is a law-enforcement action, not an ICT incident at a client, so DORA Art. 17, 18, 24, 29 and 30 and NIS2 Art. 21(2)(d) and UK NIS 2018 are not triggered by the facts here. ## 3\. Technical analysis & attack chain This is a law-enforcement disruption of a ransomware operation, not a new intrusion technique. The chain below is the group's confirmed operating pattern as described by Europol and the reporting, followed by what the takedown does and does not change. 1. Initial access: exploitation of known vulnerabilities in unpatched, internet-facing servers. Europol's account, as carried by Help Net Security, also points to poorly secured access, particularly access linked to cloud storage. 2. Network access and data theft: once inside, KillSec stole data and copied it to its own infrastructure. 3. Extortion: the group threatened to publish the stolen data on its leak site unless paid, and ran a double-extortion scheme charging separately to delete stolen data and to provide decryption keys. 4. Ransomware deployment: the group deployed ransomware after data theft, consistent with the double-extortion model. 5. Payment: Europol states that in some cases the group obtained "substantial ransom payments". The RaaS commercial model is the part that matters for exposure. KillSec launched its platform in June 2024, charged a $250 entry fee for access, and let affiliates keep 88% of successful ransom payments. That is one of the cheapest entry points documented on the dark web, which is why the group gathered a following despite being low-to-mid tier. The consequence is that the arrests cover the platform operators, not the affiliate base: affiliates who rented the platform retain any data they exfiltrated and any access they established. The CVE-2025-31161 link is the one hard technical anchor. KillSec has been linked to at least one zero-day, CVE-2025-31161 in CrushFTP. The verified reference data records this as CVSS 9.8 CRITICAL, CWE-305 (Authentication Bypass by Primary Weakness), in CISA KEV since 2025-04-07, with an EPSS score of 100%. Note that the source describes it as a zero-day at the time of exploitation; the verified classification is an authentication bypass by primary weakness, and the two descriptions are consistent with a flaw in CrushFTP's authentication logic that was exploited before a fix was available. Any CrushFTP instance in a client estate that has not been patched against CVE-2025-31161 should be treated as compromised until proven otherwise, given the 100% EPSS and KEV status. The leak site was live as recently as 27 September 2026, three days before the servers were seized, so the group was still operating at the point of disruption. That also means victim listings published up to that date are a real record of who was targeted, and clients should check whether they appear. Confidence caveats. The arrest details, the 1,000-plus attack figure, the 500-plus success figure, the $250 entry fee and the 88% affiliate split all rest on Europol and Eurojust statements as relayed by the reporting; treat them as single-sourced to law enforcement and not independently corroborated. The attribution of KillSec to any named threat actor is unconfirmed: the verified reference data contains no MITRE ATT&CK profile for "KillSec", so no actor mapping should be applied. The CVE-2025-31161 link to KillSec is stated in the source but is not corroborated by a second source in this corpus. ## 4\. Mitigation & containment P1 within 24 hours - Inventory every CrushFTP instance and confirm patch status against CVE-2025-31161\. This is the only CVE named in this item, it is in CISA KEV, and EPSS is 100%. If a system cannot be patched, take it off the internet-facing perimeter or place it behind an authenticating reverse proxy. - Search for any client data or client name on the KillSec leak site listing as of 27 September 2026\. If present, treat the data as exfiltrated and start the incident process under DORA Art. 19 or NIS2 Art. 23 as applicable. - If a ransom was paid to KillSec, do not assume the decryption key or the deletion commitment survives the takedown. Affiliates, not the seized platform, hold the data. Escalate to legal and to the incident response retainer. P2 within 72 hours - Review cloud storage access controls for the pattern Europol describes: poorly secured access linked to cloud storage. Enforce authentication on any storage bucket or share that is reachable from the internet, and audit for anonymous or public read. - Hunt for the double-extortion sequence in logs: bulk data read or copy from file shares and cloud storage followed by outbound transfer to unfamiliar infrastructure, then encryption events. The data-theft stage precedes the ransomware stage, so the exfiltration window is the one to search. - Confirm that any KillSec-related incident already open has a documented classification decision. The takedown does not reset the clock on DORA Art. 19 or NIS2 Art. 23 reporting. P3 within 7 days - Reassess third-party risk under DORA Art. 28 for the affiliate model: a RaaS platform means the client's exposure is to whoever rented the tooling, not to the named group. Where a client has a vendor relationship that was compromised via a KillSec affiliate, the vendor's own incident handling should be tested against DORA Art. 30 contractual provisions. - Feed the CVE-2025-31161 patch state into the vulnerability management reporting cycle and confirm no CrushFTP instance remains unpatched. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file paths, registry keys or command lines. The sources do describe observable behaviours. These are not atomic indicators and are not machine-pivotable, so they are listed separately. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | ------------------------------------------------------------ | | Exploitation of unpatched internet-facing servers, including CrushFTP CVE-2025-31161 | Web server and application logs on internet-facing hosts; CrushFTP logs | High for the CVE link as stated in source; single-sourced | | Access via poorly secured cloud storage | Cloud storage access logs; identity provider sign-in logs | Medium; single-sourced to Europol via Help Net Security | | Bulk data copy to external infrastructure before encryption | Egress proxy, firewall and DLP logs; cloud storage audit logs | Medium; consistent with the double-extortion model described | | Victim listing on the KillSec leak site | External threat intel monitoring of the seized leak site | High for listings up to 27 September 2026 | ## 6\. Detection Insufficient indicators to author detection rules. The sources provide no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values that are artefacts of the threat itself. The only named technical artefact is the CVE identifier, which is not a threat artefact and would detect reporting about the threat rather than the threat. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-31161](https://nvd.nist.gov/vuln/detail/CVE-2025-31161?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2025-04-07 | 100% | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DM… | ## 7\. Sources - Risky Business, "Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe", https://news.risky.biz/risky-bulletin-authorities-dismantle-killsec-group-arrest-members-across-europe/, 2026-10-02 - The Hacker News, "Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers", https://thehackernews.com/2026/10/police-arrest-16-year-old-suspected-of.html - The Record (Recorded Future), "Police disrupt KillSec ransomware, arrest suspected teenage leader", https://therecord.media/killsec-ransomware-raas-arrests-europe - DataBreaches.net, "Teenagers suspected of leading KillSec ransom group arrested during international operation", https://databreaches.net/2026/10/01/teenagers-suspected-of-leading-killsec-ransom-group-arrested-during-international-operation/, 2026-10-01 - Help Net Security, "16-year-old suspected leader of KillSec ransomware group arrested", https://www.helpnetsecurity.com/2026/10/01/killsec-ransomware-16-year-old-main-operator-arrested/, 2026-10-01 ## 8\. Adverse Trace position Adverse Trace assesses the disruption as a genuine reduction in the KillSec brand's operational capacity but not a reduction in the underlying risk to clients. The platform, the leak site and the servers are gone, and three people are in custody, but the affiliate base that rented the platform was not the target of the arrests and retains any exfiltrated data and any access it established. CVE-2025-31161 remains in CISA KEV with an EPSS score of 100% and a CVSS of 9.8, so the access path KillSec used is still open wherever CrushFTP is unpatched. Attribution to a named actor is unconfirmed: the verified reference data holds no MITRE ATT&CK profile for KillSec, and we will not map it to one. We will monitor for affiliate activity that reuses KillSec tooling or victim data under a different brand, and we will flag any client that appears on the archived leak site listing. Clients with an open KillSec-related incident should contact their Adverse Trace handler to confirm the incident classification and reporting position under DORA Art. 19 or NIS2 Art. 23 before the reporting window closes. --- [Read the original source →](https://news.risky.biz/risky-bulletin-authorities-dismantle-killsec-group-arrest-members-across-europe/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*