DIICOT detained a 24-year-old man in an international operation against the “KillSec” group, accused of approximately 1,000 cyberattacks

DIICOT has detained a 24-year-old man and conducted four searches in Bucharest and Vaslui County as part of the international “KillSwitch” operation, which targets the dismantling of the “KillSec” cybercrime group. The group is considered responsible for approximately 1,000 cyberattacks worldwide.

According to investigators, the organization was established in October 2023 and used command-and-control servers hosted on global cloud services, false identities and encrypted channels. Its members purchased access credentials on the Darknet, exploited vulnerabilities and stole data, then blackmailed their victims for cryptocurrency ransoms.

In December 2025, Romania and Belgium formed a joint investigation team under the coordination of Eurojust, later joined by Greece and Germany. On September 30, 2026, simultaneous actions took place in several countries, with the support of Europol and EC3.

Authorities took control of the KillSec website and secured at least 110 terabytes of data. The young man is being investigated for forming an organized criminal group, cybercrime offenses and blackmail. Prosecutors requested his pretrial detention for 30 days.