Police dismantle KillSec ransomware group allegedly run by a 16-year-old

Police in 10 countries have taken down the KillSec ransomware-as-a-service operation and arrested three suspects, including a 16-year-old investigators believe was its leader and administrator, Europol and Spanish police said Oct. 1.

KillSec offered cheap, easy-to-use extortion tools to low-skilled criminals. Europol links the group to about 1,000 suspected attacks worldwide since it emerged in 2024, with about 500 so far identified as successful, a figure the agency said could change.

What happened

The action, called Operation KillSwitch, took place Sept. 30 and was led by German authorities in Hamburg with support from Europol and Eurojust, BleepingComputer reported. Police searched eight properties in Greece, Romania, Spain and the United Kingdom, shut down five servers including KillSec's main server, seized its dark web leak site and secured at least 110 terabytes of stolen data. Belgium, Finland, the Netherlands, Switzerland and the United States also took part, along with security firms Bitdefender and Group-IB.

According to The Record, Catalan police and the Civil Guard's cybercrime unit arrested the 16-year-old, a Romanian national, in Alicante. In the U.K., police arrested Dutch national Fouad Eltibrizi, who allegedly used the alias "Archduke." A U.S. federal grand jury in Puerto Rico indicted him on Sept. 16 for conspiracy to commit unauthorized computer access, and he is awaiting extradition. A suspected developer, who turned 18 in August and was a minor during some of the alleged offences, has also been identified.

How KillSec operated

Investigators said the group broke into organizations through software vulnerabilities and poorly secured edge devices, often targeting misconfigured cloud storage, then threatened to publish stolen data on its leak site. BleepingComputer reported that members used AI to help build infrastructure and find victims. At least 70 suspected attacks involved German organizations. Threat intelligence firm Halcyon, cited by The Record, said victims included health-care companies, government bodies and financial services firms.

The leak site now shows a seizure banner. Investigators are still analyzing evidence, tracing cryptocurrency and looking for more victims and suspects.

What we don't know yet

Coverage of the operation did not mention Canadian victims or Canadian police involvement. Organizations that were extorted by KillSec may hear from investigators as the seized data is reviewed.

What to do

• Audit cloud storage buckets for public access and misconfigured permissions.
• Patch internet-facing devices and remove unused remote access.
• Report any past KillSec extortion attempt to police, who may now hold the stolen data.