● Covered by 4 sources · 4 reportsMedium impact3 neutral1 positive
International Law Enforcement Dismantles KillSec Ransomware Group, Identifies Teen Leader
Key points
- KillSec ransomware group's operations were disrupted by "Operation KillSwitch."
- A 16-year-old was identified as the alleged administrator and main operator.
- Three provisional arrests were made, and eight properties were searched.
- Law enforcement seized KillSec's dark web leak site and five core servers.
- Access to 110TB of stolen data was blocked, preventing further unauthorized access.
- The 16-year-old alleged administrator is a Romanian national.
- Fouad Eltibrizi, also known as "Archduke," was arrested in the U.K. and indicted in the U.S.
- KillSec emerged in 2024 and launched approximately 1,000 attacks.
- KillSec exploited cloud storage vulnerabilities.
- The arrests occurred on September 30.
- Police and prosecutors in Hamburg, Germany, led the operation.
- The other two arrested individuals are in their 20s.
- U.S. prosecutors in Puerto Rico and the FBI's San Juan office participated in the operation.
Operation KillSwitch Disrupts KillSec Ransomware
International law enforcement agencies, in an operation dubbed "Operation KillSwitch," have dismantled the KillSec ransomware group. This coordinated action led to the seizure of the group's dark web leak site and five core servers, effectively disrupting its operations.
The operation involved authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom, with participation from Europol and Eurojust. Cybersecurity companies Bitdefender and Group-IB also assisted in the investigation.
Teen Identified as Alleged Leader
Investigators identified a 16-year-old as the alleged administrator and main operator of the KillSec ransomware group. The investigation also identified a suspected developer who turned 18 in August, a suspected negotiator, and a suspected affiliate. The search for other potential members is ongoing.
Three provisional arrests were made, and eight homes were searched in Greece, Romania, Spain, and the UK as part of the operation.
Seizure of Infrastructure and Data
On September 30, police took control of KillSec's dark web leak site, blocking unauthorized access to at least 110TB of data believed to be stolen from victims. The group used this site to threaten organizations with publishing stolen files unless a ransom was paid, offering files as free downloads for those who refused.
Authorities also gained control of five core servers, which the gang used to manage operations and store stolen victim data. KillSec's domains now redirect visitors to a law enforcement seizure notice.
Scope of KillSec's Activities
KillSec is linked to approximately 1,000 suspected attacks worldwide. The investigation into the group began in 2025, leading to the identification of key suspects within the cybercrime organization.
Updates
- The 16-year-old alleged administrator is a Romanian national.
- Fouad Eltibrizi, also known as "Archduke," was arrested in the U.K. and indicted in the U.S.
- KillSec emerged in 2024 and launched approximately 1,000 attacks.
- KillSec exploited cloud storage vulnerabilities.
- The arrests occurred on September 30.
- Police and prosecutors in Hamburg, Germany, led the operation.
- The other two arrested individuals are in their 20s.
- U.S. prosecutors in Puerto Rico and the FBI's San Juan office participated in the operation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Police in Spain arrested a 16-year-old suspected of operating the KillSec ransomware group, which stole data and demanded payment to prevent its publication. This operation also led to two other arrests in the UK and Romania, and the seizure of KillSec's leak site and servers, disrupting the group's activities.
Police in Spain arrested the suspected 16-year-old leader of the KillSec ransomware group, a Romanian national, as part of an international operation that also seized the group's leak site and servers. The group, which emerged in 2024, launched approximately 1,000 attacks, exploiting cloud storage vulnerabilities to extort victims.
An international law enforcement operation, "Operation KillSwitch," seized the KillSec ransomware gang's servers and data leak site, leading to three arrests. Authorities identified a 16-year-old as the group's suspected main operator and seized 110 terabytes of stolen data.
Europol and international law enforcement agencies have shut down the KillSec ransomware group, identifying a 16-year-old as its alleged administrator and main operator. The operation seized KillSec's dark web leak site and five core servers, blocking access to 110TB of stolen data and disrupting the group's operations.