KillSec: hacker network dismantled, Switzerland involved

Context

In brief

• Three people arrested in the operation against KillSec
• Five servers seized and 110 terabytes recovered
• Eight searches in Spain, Greece, the United Kingdom and Romania
• The Swiss proceedings are still ongoing

Key Facts

• Group → KillSec, or KillSecurity
• Arrests → three people
• Servers seized → five
• Data recovered → 110 terabytes
• Searches → eight in four countries
• Attacks against Swiss companies → October 2023-June 2025
• Swiss proceedings → initiated in July 2025 against unknown persons
• Coordination → Europol and Eurojust with seven other countries

Three people were arrested and five servers, which were used to store victims' data, were seized in the international operation that dismantled the IT infrastructure of KillSec, a group responsible for ransomware attacks. The authorities involved include the Office of the Attorney General of Switzerland (OAG) and the Federal Office of Police (fedpol).

The operation took place yesterday, according to a joint statement from the Swiss authorities. The eight searches carried out in Spain, Greece, the United Kingdom and Romania made it possible to recover 110 terabytes of stolen data. The balance sheet released therefore includes arrests, seizures and the recovery of a large amount of stolen information.

The Swiss involvement stems from a criminal case initiated by the Federal Prosecutor's Office against unknown persons in July 2025. The investigation concerns ransomware attacks perpetrated by the KillSec group, whose full name is KillSecurity, against several Swiss companies in the period between October 2023 and June 2025. The initiation of the procedure is therefore subsequent to the time interval of the attacks indicated by the authorities.

The Swiss procedure

According to the statement, the group uses so-called double extortion. First, it improperly enters the victim's system, copies and extracts the data of interest, and encrypts the servers; then it demands a ransom in exchange for the decryption key. If the company refuses to pay, for example because it made a backup before the data was stolen, the perpetrators threaten to publish the information on the darknet.

The OAG and fedpol participated in the international investigations coordinated by Europol and Eurojust together with seven other countries. The proceedings in Switzerland are still ongoing and the alleged offences include data theft, abusive access to a computer system, data damage and extortion.

The authorities' reconstruction describes ransomware as a sequence of intrusion, copying and extraction of data, encryption of servers and demand payment. The ransom is often demanded in cryptocurrency. This is the dynamic described in the Swiss file on the KillSec attacks.

Operational details

Why the case concerns Swiss companies

The national significance of the case lies in the fact that the Swiss proceedings concern several Swiss companies affected by attacks between October 2023 and June 2025. For those who work in a company, the risk described does not coincide with a single moment: it includes access to the system, data theft, server blocking and ransom pressure.

Separating these passages helps to correctly read double extortion. The source treats encryption and the threat of publication as two linked levers. The issue therefore also concerns the aziende che assumono market, although it does not link every Swiss company to the investigated group.

Double extortion in practice

The backup plays a role in the scenario reported: it may be the reason why the victim refuses payment, but according to the source, it does not eliminate the threat of making the data public. This distinguishes the availability of a copy of the data from the protection of information that has already been stolen.

The seizure of the five servers and the recovery of 110 terabytes also show the double dimension of the operation: on the one hand, the infrastructure used to store the victims' data, and on the other, the information recovered during the searches. The source does not turn these numbers into an estimate of economic damage or an amount of ransoms.

The Swiss proceedings remain open. For this reason, the statement speaks of hypothetical crimes and does not present a definitive conclusion on criminal responsibility. The presence of Europol, Eurojust and seven other countries also places the Swiss dossier within an international investigation, with searches carried out in four European countries.

Useful tools to protect your net income

To reduce FX leakage, compare CHF-EUR exchange options and banks for cross-border workers.

Key points

From news to an operational verification

To transform the facts into an operational reading, a Swiss company can reconstruct the episode following the sequence described by the authorities. The path serves to distinguish the type of action taken and the phase in which the economic request appears, without adding procedures or deadlines that the source does not indicate.

Five steps to rebuild the attack

1. Check the first element of the sequence: undue access to the victim's computer system. 2. Separate the input from the copying and extraction of the data of interest, which in the ransomware description takes place before encryption. 3. Ascertain whether the servers have been encrypted, because the lock precedes the request for the decryption key. 4. Identify the ransom note and consider that, according to the source, payment is often demanded in cryptocurrency. 5. Evaluate the second pressure: if the victim refuses, also because he has a backup, the indicated threat is the publication of the data on the darknet.

To place an episode in the Swiss file, the time reference is the one reported by the authorities: the attacks attributed to KillSec against several Swiss companies are between October 2023 and June 2025, while the criminal proceedings against unknown persons were initiated in July 2025. The chronology helps to compare the facts, but the proceedings are still ongoing.

The sequence also makes it possible not to confuse the seizure of the servers with the outcome of the investigation. The international operation led to arrests, searches and data recovery; on the Swiss level, however, hypothetical crimes such as data theft, abusive access, data damage and extortion remain indicated. The reference to cryptocurrencies concerns the ransom demand and should not be confused with the tools dedicated to conti bancari in Svizzera.

To complete the reading with a portal tool, use the calcolatore stipendio.

Source: swissinfo.ch