The 16-year-old hacker who attacked the Generalitat and half the rest of the world

BarcelonaFrom his room in a house in Alicante, where he lived with his mother, a 16-year-old boy managed an international network of hackers that had carried out more than 1,000 cyberattacks around the world. He had even perpetrated a cyberattack against the Government of Catalonia, specifically at Infraestructures.cat, causing damages close to one million euros last year. They called themselves KillSec and were specialists in using malicious software (ransomware) and demanding ransoms to recover the stolen data.

Now, this minor has already been arrested by the Mossos d'Esquadra and the Civil Guard, but the investigation is of a much larger scope: he was arrested in the framework of an international operation, which has extended to other countries in Europe and in which Europol and the FBI have taken part. In addition to the minor, there are two other detainees. The investigation has involved the authorities of Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom, and the United States.

The investigation by the Mossos began following the attack against Infraestructures.cat at the beginning of 2025. The hackers had accessed the company's systems, had stolen sensitive information, and had attempted to extort the institution. The entity assures that since then they have better protected their systems and that from the first moment the response was immediate and effective, with the support of the Cybersecurity Agency of Catalonia, and that the incident did not affect the activity of the workers and did not compromise relevant data of the company. They also did not pay any kind of ransom.

Joint investigation

In parallel, the Civil Guard initiated another investigation following a request for collaboration from the FBI of San Juan, Puerto Rico, aimed at identifying individuals related to KillSec who could be residing in Spain. Starting from a profile picture, Civil Guard investigators identified one of the criminal group's administrators, the young man who resides in the province of Alicante. Thus, a joint investigation group was born between the two police forces.

Of the thousands of cyberattacks worldwide carried out by this group of hackers, about 500 were reportedly successful. The group is said to have accumulated more than 280 victims, some of whom paid ransoms of around 500,000 euros in cryptocurrencies. According to a statement released by the Catalan police, Tuesday's operation succeeded in dismantling KillSec's infrastructure, including their leak site. Furthermore, they were able to secure at least 1,100 terabytes of data. During the investigation, five central servers were also placed under police control and several internet domains were seized.

'Modus operandi'

The KillSec method –active approximately since 2024– consisted of accessing organizational systems by exploiting security holes (vulnerabilities) and poorly protected access points, especially in storage environments, such as servers. Its members would copy sensitive internal information and move it to infrastructures under their control.

The victims appeared identified on a dark web leaks site and received threats to publish the stolen data if they did not pay the demanded ransom. If they refused to pay, the attackers could end up making the files available to everyone for free download.