Police Target KillSec Ransomware Group with Arrests and Seizures
European police seized KillSec infrastructure and arrested suspects, including a 16-year-old alleged ringleader.
Operation KillSwitch, led by German police with Europol, targeted KillSec, a ransomware group active since 2024 that Europol says completed at least 500 attacks. Officers seized the leak site, five servers, and domains, and said they prevented exposure of at least 110TB of stolen data. Searches in Spain, Greece, Romania, and the UK produced three provisional arrests, including a 16-year-old Romanian alleged administrator detained in Alicante. Group-IB identified 274 publicly claimed victims, about 35% in the US and 17% in India, and US prosecutors indicted Dutch national Fouad Eltibrizi, arrested in the UK, on hacking and extortion charges.
- Europol says KillSec completed at least 500 attacks since 2024.
- Police seized the leak site, five servers, and blocked 110TB of data.
- A 16-year-old alleged administrator was arrested in Alicante, Spain.
- Group-IB counted 274 claimed victims, about 35% US and 17% Indian.
- Dutch national Fouad Eltibrizi was indicted and arrested in the UK.
Full article440 words · extracted from infosecurity-magazine.com · click to collapse
Law enforcers have struck at a prolific ransomware group thought to be responsible for hundreds of cyber-attacks, arresting its 16-year-old suspected ringleader.
KillSec has been in operation since 2024 and carried out at least 500 successful attacks in that time, although it is responsible for twice that number, according to Europol.
Led by German police, Operation KillSwitch saw law enforcers seize the group’s leak site and prevent at least 110TB of stolen data from being exposed, it explained.
In total, police claimed five servers that were used to manage the group’s activities and store data taken from victims, as well as domains operated by KillSec which are now redirecting visitors to a police seizure notice.
Read more on KillSec: KillSec Ransomware Hits Brazilian Healthcare IT Vendor
The RaaS outfit targeted organizations by exploiting software vulnerabilities and poorly secure cloud storage access points, according to Europol.
Group-IB, which was involved in the operation, identified 274 publicly claimed victims, most of which were US (35%) and Indian (17%) organizations.
Although the group used Windows and VMware ESXi virtualization lockers, it didn’t always encrypt; stealing and extorting data on some occasions. It apparently acted as both a ransomware operator and data broker, advertising stolen data for sums ranging from $5000 to $500,000.
KillSec's operations depended on a small core team that developed the locker and approved each build, Group-IB claimed.
Arrests Target Key Members
Authorities carried out eight house searches in Spain, Greece, Romania, and the UK, seized evidence and assets, and made three provisional arrests, including a 16-year-old thought to be the administrator and main operator.
According to reports, the individual is a Romanian national who was arrested in the Spanish city of Alicante.
Others include a suspected developer who turned 18 in August 2026. Investigators also identified a third individual believed to have been a negotiator and another who was an affiliate.
“KillSec's affiliates went after the organizations people depend on most: hospitals, government bodies, and financial institutions,” said Group-IB CEO, Dmitry Volkov.
“Closing the gaps these groups exploit is essential, but it does not end an operation like this. Servers can be replaced in weeks; the people who build the platform and approve every attack cannot. Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end.”
To that end, US authorities have announced the indictment of a Dutch national living in the UK on charges related to KillSec.
Fouad Eltibrizi (aka Archduke), was arrested on September 30 by British police and is charged with hacking and extortion-related offenses that carry a maximum sentence of 10 years behind bars.