Spanish Police Dismantle KillSec Ransomware Group in Coordinated International Operation Spanish authorities, in collaboration with law enforcement agencies across Europe and the U.S., have arrested three individuals linked to the KillSec ransomware group, including a 16-year-old suspected administrator detained in Alicante on September 30. The operation, led by Hamburg police and prosecutors, also resulted in the seizure of KillSec’s leak site and the shutdown of five servers hosting stolen victim data. The arrests targeted key members of the group: the 16-year-old in Spain, a 20-something in the U.K., and a 24-year-old in Romania, the latter facing charges including organized crime, illegal data access, and blackmail. U.S. prosecutors in Puerto Rico have filed an extradition request for the U.K. suspect, while Romanian authorities secured a 30-day custody order for their detainee. Investigators identified four distinct roles within KillSec administrator, developer, negotiator, and affiliate though the specific roles of the arrested individuals remain undisclosed. A suspected developer, who turned 18 in August, was identified but not detained, as some alleged offenses occurred while they were a minor. The operation, coordinated by Europol and Eurojust, involved eight searches across Spain, Greece, the U.K., and Romania, resulting in the seizure of 110 terabytes of data, cryptocurrency wallets, and computer equipment. Authorities also took control of five domains linked to the group, displaying police seizure notices. KillSec operated by exploiting software vulnerabilities and insecure cloud storage, stealing sensitive data, and threatening to publish it unless victims paid ransoms. The group used AI to build infrastructure and identify targets, though details remain limited. Investigators estimate 1,000 suspected attacks worldwide, with 500 confirmed successful breaches and over 280 victims in Spain alone. The group reportedly extorted substantial ransom payments, sometimes selling stolen data to other criminals if demands were unmet. Originally a hacktivist collective active since 2021, KillSec transitioned to ransomware in October 2023, deploying KillSecurity 2.0 and 3.0 to encrypt files. By June 2024, it adopted a ransomware-as-a-service (RaaS) model, recruiting affiliates to carry out attacks. While authorities declared the group "successfully shut down," investigations continue to trace financial flows, analyze seized evidence, and identify additional suspects or victims. The case remains ongoing, with further developments expected.

Operation Endgame Expands: Europol Adds 131K Email Addresses in Latest Data Breach Wave Europol has released an additional 131,000 email addresses as part of the fourth wave of Operation Endgame, a large-scale cybersecurity crackdown targeting malware and botnet infrastructure. The new dataset, published today, overlaps with existing breach records 36% of the exposed emails were already documented in the Have I Been Pwned database. Operation Endgame, a coordinated effort involving law enforcement agencies across multiple countries, aims to disrupt cybercriminal operations by seizing infrastructure, arresting threat actors, and exposing compromised credentials. This latest update follows prior disclosures, reinforcing the campaign’s ongoing impact on cybercrime networks. The breach data, now publicly accessible, highlights the persistent risk of credential reuse and the scale of cybercriminal targeting. Europol’s continued releases serve as a resource for security teams to identify and mitigate exposure within affected organizations.

Global Authorities Dismantle "AudiA6," a Major Cryptocurrency Laundering Network Linked to Ransomware Groups In a coordinated international operation, law enforcement agencies have dismantled AudiA6, a sophisticated cryptocurrency laundering service that processed over €336 million between 2022 and 2025. The platform, a critical financial hub for ransomware operators and cybercriminal networks, enabled threat actors to obscure illicit funds through rapid, complex transaction chains while evading detection. The takedown, executed on June 10, involved the U.S. Secret Service, IRS Criminal Investigation, Polish law enforcement, Europol, and Eurojust, alongside other global partners. Authorities arrested two suspected administrators one Ukrainian and one Russian in Georgia, seized 30+ servers, took down 25 domains, and froze cryptocurrency assets worth hundreds of thousands of euros. Additional assets, including vehicles and properties, were confiscated, and associated Telegram accounts and dark web platforms were shut down, replaced with official seizure notices. AudiA6 operated as a professional laundering service, advertised on underground forums, allowing cybercriminals including ransomware affiliates to transfer stolen cryptocurrency and receive "cleaned" funds within an hour. The service charged 3–10% commissions and relied on a network of 6,000+ fraudulent accounts, many tied to stolen identities and managed by Russian-speaking intermediaries. These accounts were used to move funds across exchanges, often bypassing compliance checks through commercial email services and custom domains. Investigators also linked AudiA6 to the Dark2Web cybercrime forum, a marketplace for illicit services and a hub for threat actor coordination. Europol connected the platform to 15+ ransomware and cryptocurrency theft investigations, highlighting its role as a central enabler in the cybercrime ecosystem. The operation aligns with Europol’s findings on the growing professionalization of cryptocurrency laundering, where services increasingly use chain-hopping, decentralized exchanges, and mixers to evade anti-money laundering controls. While the takedown disrupts a key financial pipeline for ransomware groups, authorities note that similar services continue to evolve, sustaining the global cybercrime economy.

Europol’s Operation PowerOFF Disrupts Global DDoS-for-Hire Networks Europol, in coordination with 21 national law enforcement agencies, has executed Operation PowerOFF, a large-scale crackdown on DDoS-for-hire (booter) services operating across multiple countries. The operation resulted in four arrests, the seizure of 53 domains, and the execution of 25 search warrants as part of a global effort to dismantle cybercriminal infrastructure. Leading up to the action, authorities conducted operational sprints targeted strikes against high-value users of DDoS-for-hire platforms while raising awareness about the illegality of these services. The takedowns disrupted key technical components, including servers and databases, crippling the infrastructure that enables DDoS attacks. During the operation, law enforcement uncovered three million criminal user accounts linked to the seized platforms. In response, authorities launched a warning campaign, sending 75,000 emails to suspected customers and placing ads on search engines to deter users searching for DDoS-for-hire tools. Additionally, over 100 URLs advertising these services were removed from search results, and blockchain-based warning messages were deployed to disrupt illicit payment channels. DDoS-for-hire services rely on botnets networks of compromised devices, including home routers, smart TVs, and IoT appliances infected with malware. Cybercriminals then rent access to these botnets through simple dashboards, enabling even unskilled attackers to launch disruptive denial-of-service attacks. The operation marks a significant blow to the DDoS-as-a-service ecosystem, reducing the availability of these tools and increasing risks for both providers and users.

Japan Faces Surge in Ransomware and Cyber Threats in First Half of 2024 Japan’s National Police Agency (NPA) reported a sharp rise in cyber threats during the first six months of 2024, with 123 ransomware attacks the highest half-year total on record. Suspicious access attempts at police internet connection points also surged, averaging 13,687 per IP address daily, a 4,000-case increase from the same period in 2023. Of the ransomware incidents, 79 targeted small and medium-sized businesses, while 31 hit large corporations, with manufacturing (37 cases) being the most affected sector. Many victims faced prolonged recovery times often exceeding a month with virtual private network (VPN) equipment identified as the primary infection vector. The NPA has recovered 20.11 million files using a proprietary decryption tool, which has also been shared with Europol for global use. Meanwhile, phishing emails declined to 731,000 (down 465,000 year-over-year), though China was the estimated source of 45% of analyzed attacks. Financial cybercrime also rose, with 127 business email compromise (BEC) scams causing losses of ¥3.88 billion ($25 million), and 253 unauthorized online banking transfers totaling ¥2.07 billion. Police issued 50,213 warnings for suspected illegal job recruitment on social media, a 14,576 increase, and are expanding AI-driven detection efforts. Overall, authorities investigated 7,607 cybercrime cases up 982 from 2023 including 1,945 linked to money laundering. The data underscores Japan’s escalating cybersecurity challenges amid evolving attack methods.

In a sophisticated cyberattack campaign, the Carbanak banking Trojan, manipulated by the hacker group Fin7, caused substantial financial loss to banks in over thirty countries. Leveraging a malware, the attackers infiltrated financial institutions' networks through phishing, enabling them to commit ATM jackpotting and compromise point-of-sale data. This operation, detailed by Europol, spanned several years with the criminals meticulously planning each intrusion, which lasted two to four months. The total theft exceeded €1 billion, marking it as one of the most significant financial cybercrimes. The impact extended beyond financial loss, raising concerns about cybersecurity measures in the banking sector and the evolving threats of sophisticated malware. Arrests in Spain and the U.S. have made some headway in dismantling the network, yet the full scope of Carbanak's reach and the current status of Fin7 remain concerning.

In one of the most significant cybercrime investigations, Europol discovered a series of sophisticated malware attacks targeting financial institutions worldwide. The malware, known as Carbanak and later iterations like Odinaff, allowed cybercriminal gangs, notably Fin7, to perform financial theft on an unprecedented scale. Exploiting vulnerabilities in banking security systems, the attackers managed to steal over €1 billion by manipulating ATM systems and point-of-sale terminals, capturing the details of millions of payment cards. The intricate operations involved using malicious documents to compromise financial companies' networks, enabling them to jackpot ATMs and siphon funds through mules into criminal accounts. The impact of these attacks highlights severe shortcomings in cybersecurity protocols within affected organizations, leading to significant financial and reputational damage. Despite arrests in Spain and the U.S., the full extent of the network and the ongoing threat posed by similar malware attacks remain concerns for the global financial sector.

In one of the most significant cyber heists, the Carbanak banking Trojan, attributed to the criminal group Fin7, led to losses exceeding €1 billion across banks in over thirty countries. This meticulously executed operation began with the leak of Carbanak's source code in 2013, empowering several gangs to perpetrate extensive financial theft. Employing spear-phishing tactics, the attackers lured employees of financial institutions to click on malicious documents, facilitating unauthorized network access. This access enabled them to manipulate ATMs for cash withdrawals and compromise point-of-sale systems. The process of each theft spanned months, involving mules to funnel stolen funds into criminal accounts. Despite arrests, including the gang's leader in Spain and three Ukrainian individuals by the U.S. DOJ, the full extent of the network and its operations, including potential ongoing activities, remains partly veiled. Europol's involvement in tackling this cybercriminal enterprise underscores the intricate, cross-border nature of combatting cybercrime, emphasizing the need for robust cybersecurity measures and international cooperation.