A 25-year-old man has been arrested in Levenshulme, Manchester, under a major Europe-wide investigation into ransomware networks, police have confirmed. The man is suspected of acting as a negotiator between an alleged criminal group and its victims.
He was due to appear at Westminster Magistrates' Court in London on Thursday, October 1, for an extradition hearing, although the Eastern Region Special Operations Unit (ERSOU), the specialist policing unit involved in the UK operation, has not specified a country.
Coordinated strikes across Europe
Ransomware networks are criminal operations that threaten organisations with the release of stolen files unless a ransom is paid. Multiple arrests were made across Europe in coordinated strikes on Wednesday.
In a statement, ERSOU said police from its specialist cyber-crime unit joined law enforcement agencies from nine countries to arrest suspected members of an alleged organised criminal gang and seize infrastructure linked to KillSec.
KillSec dark web leak site
Active since around 2024, KillSec was described by police as a dark web leak site used to extort victims and publish stolen data. ERSOU said it suspects the site threatened organisations with the release of stolen files unless a ransom was paid.
The statement said: "An international investigation, known as Operation KillSwitch, is being led by German law authorities and relates to around 1,000 suspected attacks worldwide. Police said it included 28 victim companies across the UK."
Arrests and seizures
Alongside ERSOU, the enforcement activity involved several European law enforcement agencies, supported by Europol, Eurojust and authorities from the United States.
"It took place at eight properties throughout Greece, Romania, Spain and the UK. Three suspects were arrested during searches, which also led to the seizure of evidence and assets. Those detained include a suspected administrator and principal operator of KillSec, as well as an alleged developer," the statement added.
ERSOU officers led part of the investigation into the 25-year-old man, who was arrested at an address in Levenshulme with assistance from cyber colleagues from the North West Regional Organised Crime Unit and the Joint International Crime Centre (JICC). He has not been named.
Detective Sergeant John Collinson, from ERSOU's Cyber Crime Unit, said: "Cyber criminals involved in ransomware attacks often believe they can hide behind technology and operate beyond the reach of law enforcement.
"This operation demonstrates that coordinated international action can identify those responsible and disrupt the infrastructure they rely upon. Ransomware can have a devastating impact on organisations, causing significant financial losses, operational disruption and harm to public confidence."
