#eurojust
2 cases
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictmentRansomwareExtortion & Blackmail
Operation KillSwitch seized KillSec's leak site and five servers on 30 September 2026, securing 110 TB of stolen data. A 16-year-old is the alleged main operator; a Dutch national is indicted in Puerto Rico. What the primary sources say, and where the numbers diverge.
RansomwareExtortion & Blackmail
Operation Saffron: Europol dismantles First VPN, the bulletproof anonymity layer behind years of ransomware casesDarknet & Illicit MarketsRansomware
On May 19-20, 2026, Europol and Eurojust's Operation Saffron took down First VPN — a bulletproof service running since 2014 and used by 25+ ransomware groups. Investigators infiltrated it, seized 33+ servers and unmasked ~506 users. The Ukrainian admin was searched and interviewed, not arrested.
Darknet & Illicit MarketsRansomware