European Police Arrest 16-Year-Old KillSec Ransomware Operator

Police in Europe have arrested a 16-year-old Romanian national suspected of running the KillSec ransomware group, in an international operation that seized the gang’s leak site, shut down its servers and secured more than 110 terabytes of stolen data.

Officers from Spain’s Guardia Civil and the Mossos d’Esquadra detained the teenager in the province of Alicante on 30 September. He is suspected of acting as KillSec’s administrator and main operator. Two further suspects, both in their twenties, were arrested the same day in the United Kingdom and Romania. A fourth person, a developer who turned 18 in August and was a minor when some of the offences were allegedly committed, has been identified but not arrested.

Hamburg police announced the arrests on 1 October. The operation, known as Operation KillSwitch, was led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor’s Office, with coordination from Europol and Eurojust. Authorities from Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the United Kingdom and the United States took part. The security firms Bitdefender and Group-IB supported the investigation.

The probe covers around 1,000 suspected attacks worldwide over two years. About 500 have so far been identified as successful, and Europol said both figures could change as investigators examine the seized evidence. Law enforcement took control of KillSec’s dark web leak site on 30 September and redirected five of the group’s domains to a police seizure notice. Five central servers were also brought under police control, including the group’s main server and systems used to store data taken from victims. Police searched eight properties across Spain, Greece, Romania and the UK and seized computer equipment, phones and cryptocurrency wallets in Spain. Spanish police said a first analysis of the seizures found transactions matching ransom payments from some victims.

The only suspect named publicly is Fouad Eltibrizi, a Dutch national living in the UK who used the online handle Archduke. A federal grand jury in Puerto Rico indicted him on 16 September on charges of conspiracy to access computers without authorisation for financial gain, damaging protected computers and transmitting extortion threats. He was arrested in Britain on 30 September pending extradition to the United States, where he faces up to 10 years in prison if convicted.

“The defendant and his co-conspirators carried out targeted intrusions against multiple companies and organizations, stealing highly sensitive information and attempting to extort their victims for substantial sums of money,” said Héctor Ramírez-Carbó, acting US attorney for the District of Puerto Rico.

His indictment describes how the group operated in practice. In March 2025, KillSec announced on its leak site that it had breached a company in Puerto Rico and gave it seven days to pay, posting samples of stolen patient data alongside the demand. When the firm did not respond, the group published roughly 180 gigabytes of its data on the dark web. The indictment lists similar breaches in California, Washington state and Louisiana.

KillSec gained access to organisations by exploiting software vulnerabilities and poorly secured access points, particularly cloud storage, according to Hamburg police and Europol. Members copied sensitive internal data to servers under their control, named victims on the leak site and threatened to publish the files unless paid. Where a victim refused, the stolen data was offered as a free download. In some cases, the group obtained substantial ransom payments, Europol said. The group also sold stolen data outright, with asking prices ranging from 5,000 dollars for one company’s records to 500,000 dollars for data it claimed to have taken from a global insurer. Romanian prosecutors said members bought stolen credentials sold on the dark web and threatened to sell victims’ data to other criminal groups if no ransom was paid. Investigators also found that the group used artificial intelligence to build and maintain its infrastructure and to identify potential victims, though Hamburg police gave no detail on how.

The arrest in Spain came after a lengthy tracking effort. The Guardia Civil began its investigation in 2025 alongside the FBI’s office in San Juan, aiming to find KillSec members living in Spain. Starting from a single profile image, its investigators identified the Alicante suspect. The Mossos d’Esquadra opened a parallel case after an attack on a Catalan organisation in early 2025 caused damage estimated at close to 1 million euros.

Security researchers give a fuller picture of the group’s reach. Group-IB, which monitored KillSec’s leak site and Telegram channels, identified 274 organisations publicly named as victims. Companies in the United States accounted for around 35 percent of them, followed by India at 17 percent, with Brazil, the UK, Australia and Colombia at about 3 percent each. Asia-Pacific as a whole accounted for about 30 percent of identified victims. Group-IB’s High-Tech Crime Trends Report 2026 ranked KillSec among the ten most active ransomware groups of 2025 in Asia-Pacific, Latin America and the Middle East. Financial services and healthcare were the most affected sectors.

Rapid7 reported in 2025 that KillSec began as a hacktivist group active since at least 2021 and turned to ransomware in October 2023. In November 2024 it released a locker for VMware ESXi virtualisation hosts, capable of shutting down virtual machines, deleting snapshots and erasing logs. By January 2025 it was recruiting affiliates with technical skills, requiring a forum reputation or a 1,000-dollar deposit, and had raised its share of each ransom to 20 percent. Some affiliates also worked with other ransomware-as-a-service programs, including LockBit, RansomHub and Qilin.

In Romania, prosecutors from DIICOT detained a 24-year-old in Bucharest and searched four homes in Bucharest and Vaslui county. On 1 October they asked a Bucharest court to keep him in custody for 30 days. He is under investigation for forming an organised criminal group and related computer crime offences.

All three arrests are provisional, and the suspects are presumed innocent. Hamburg police said inquiries into other possible members continue, and the evidence may identify further victims, attacks and people involved.