The 16-year-old hacker who attacked the Generalitat and half the world more

BarcelonaFrom his room in a house in Alicante, where he lived with his mother, a 16-year-old boy managed an international hacker network that had carried out more than 1,000 cyberattacks worldwide. He had even perpetrated a cyberattack against the Government of Catalonia, specifically at Infraestructures.cat, causing damages nearing one million euros last year. They called themselves KillSec and were specialists in using malicious software (ransomware) and demanding ransoms to recover the stolen data.

Now, this minor has already been arrested by the Mossos d'Esquadra and the Civil Guard, but the investigation is of a much larger scope: he was arrested within the framework of an international operation that has extended to other countries in Europe and in which Europol and the FBI have taken part. In addition to the minor, there are two more detainees. Authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom, and the United States have participated in the investigation.

The Mossos' investigation began following the attack against Infraestructures.cat at the beginning of 2025. The hackers had accessed the company's systems, stolen sensitive information, and attempted to extort the institution. From the entity, they assure that since then they have better protected their systems.

Joint investigation

In parallel, the Civil Guard initiated another investigation following a request for collaboration from the FBI of San Juan, Puerto Rico, aimed at identifying individuals related to KillSec who could be residing in Spain. Starting from a profile picture, Civil Guard investigators identified one of the criminal group's administrators, the young man residing in the province of Alicante. Thus, a joint investigation group was born between the two police forces.

Of the thousand cyberattacks worldwide carried out by this group of hackers, about 500 were reportedly successful. The group is estimated to have accumulated more than 280 victims, some of whom paid ransoms of around 500,000 euros in cryptocurrencies. According to a statement made public by the Catalan police, the operation this Tuesday managed to dismantle KillSec's infrastructure, including its leaks page. Furthermore, they were able to secure at least 1,100 terabytes of data. During the investigation, five central servers were also placed under police control and various internet domains were seized.

'Modus operandi'

The KillSec method –active approximately since 2024– consisted of accessing organizational systems by exploiting security holes (vulnerabilities) and poorly protected access points, especially in storage environments, such as servers. Its members copied sensitive internal information and transferred it to infrastructures under their control.

The victims appeared identified on a dark web leak site and received threats to publish the stolen data if they did not pay the demanded ransom. If they refused to pay, the attackers could end up making the files available to everyone for free download.