Europol

International Law Enforcement Operation Dismantles KillSec Ransomware Group and Seizes 110 TB of Stolen Data

An international operation coordinated by Eurojust with support from Europol has dismantled the infrastructure of the KillSec ransomware group. Authorities seized five servers containing at least 110 terabytes of data stolen from victims and took control of the group's leak site domains. Three individuals were arrested, including a 16-year-old identified as the group's primary administrator and operator. The coordinated action involved law enforcement from nine countries and included eight searches across Spain, Greece, the United Kingdom, and Romania. KillSec has been active since 2024 and is linked to nearly one thousand ransomware incidents worldwide, primarily using a double-extortion model that combines data encryption with threats to publish stolen information. The seized data volume highlights the scale of the group's operations, which frequently targeted healthcare environments where system downtime directly impacts patient care.

DDoS-Guard Reports Record 540,000 L7 Attacks in June 2026 Amid Botnet Fragmentation

DDoS-Guard recorded a sharp 70% increase in L7 attacks during Q2 2026, with June alone seeing 540,000 incidents. Global volumetric attacks doubled compared to all of 2025, including peaks of 1.64 Tbps and 1.58 Tbps. Law enforcement dismantled four major IoT botnets—Aisuru, KimWolf, JackSkid and Mossad—in March, yet long-duration L7 campaigns surged 380%. Attackers shifted focus to application-layer exhaustion using browser automation and AI agents while targeting HR platforms and news sites. Europol’s Operation PowerOFF led to 75,000 warnings and 53 domain takedowns across 21 countries. Experts attribute the June spike to attacks aimed at protection providers themselves rather than single domains.