Operation KillSwitch disrupts KillSec, arrests alleged teen leader

On 30 September 2026, Operation KillSwitch arrested three KillSec suspects, including an alleged 16-year-old leader, and seized servers and about 110TB of data.

On 30 September 2026, German-led Operation KillSwitch, coordinated by Eurojust and Europol, disrupted KillSec, also called the Kill Security Ransomware Group, which has been active since about 2024; The Hacker News says it moved in June 2024 from hacktivism to ransomware-as-a-service as KillSecurity 2.0 and 3.0. Three suspects were provisionally arrested and eight properties searched in Spain, Greece, the United Kingdom, and Romania, including a 16-year-old Romanian national arrested in Alicante as the suspected administrator and main operator, with the other arrests reported in the UK and Romania. Some accounts say a developer who recently turned 18 was a minor during part of the alleged conduct, and CyberScoop alone identifies Dutch national Fouad Eltibrizi, arrested in the UK, as facing up to 10 years on an unauthorized-access conspiracy charge linked to a Puerto Rico indictment, naming Instituto de Ojos, US BioTek Laboratories, and Accelerated Academy. Authorities seized five servers, including the Tor leak site, and KillSec domains—five domains, according to The Hacker News—but disagree on whether at least 110 terabytes were seized, access to at least 110 terabytes was blocked, or more than 110 terabytes were locked down. Roughly 1,000 suspected attacks are under review and about 500 are described as successful, while victim figures conflict among about 450 leak-site names, more than 280 counted by Spanish police, 70 German organizations, and about 500 compromised organizations or victims. Participation totals also disagree—nine, ten, or eleven countries—and reported entry methods range from weak cloud storage and software or edge-device flaws to purchased dark-web credentials, with some outlets saying members used AI to build infrastructure and choose victims.

• On 30 September 2026, German-led Operation KillSwitch made three provisional arrests and eight searches in Spain, Greece, the United Kingdom, and Romania.
• A 16-year-old Romanian national arrested in Alicante is described as KillSec’s suspected administrator and main operator; The Hacker News places the other arrests in the UK and Romania.
• CyberScoop identifies Dutch national Fouad Eltibrizi, arrested in the UK, as facing up to 10 years on an unauthorized-access conspiracy charge tied to a Puerto Rico indictment, and names Instituto de Ojos, US BioTek Laboratories, and…
• Police seized five servers, including the Tor leak site, and KillSec domains—five domains with seizure notices, per The Hacker News—while outlets differ on whether at least or more than 110 TB of stolen data was seized, blocked, or locked…
• About 1,000 suspected attacks since around 2024 are under review and roughly 500 are called successful; victim counts conflict among about 450 leak-site listings, more than 280 counted by Spanish police, 70 German organizations, and about…
• Country totals disagree—nine, ten, or eleven—with Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the UK, and the US named in one nine-country list; Europol, Eurojust, the FBI, Bitdefender, and Group-IB are among supporters…
• Reported access paths include weak cloud storage, software or edge-device flaws, and bought dark-web credentials; some outlets say members used AI to build infrastructure and select victims.
• The Hacker News says KillSec shifted in June 2024 from hacktivism to ransomware-as-a-service as KillSecurity 2.0 and 3.0; some reports also identify a developer who recently turned 18 and was a minor during some alleged offenses.