Spain and Several Other Countries Target KillSec Ransomware Gang in Joint Operation; Servers and Domains Seized

Article

【Spanish police arrest 16-year-old suspected of operating the KillSec ransomware group】October 2, according to a notice from Europol, Spanish police arrested a 16-year-old Romanian national in Alicante, suspected of serving as the administrator and primary operator of the KillSec ransomware group.

Two other suspects in their twenties were arrested in the United Kingdom and Romania, respectively; a developer who turned August just turned 18 this year was identified but not arrested because some of the offenses occurred while the person was a minor.

Codenamed Operation KillSwitch, the operation was led by the Hamburg State Criminal Police Office and the city's public prosecutor's office in Germany. The investigation concerns approximately 1000 suspected attacks worldwide, of which approximately 500 have so far been confirmed as successful intrusions.

Law enforcement searched eight locations in Spain, Greece, Romania, and the United Kingdom, seized control of five central servers, and redirected the relevant domains to seizure-notice pages. They also recovered at least 110 TB of stolen data.

KillSec has been active since approximately 2024, infiltrating corporate systems by exploiting software vulnerabilities and poorly secured cloud-storage entry points, copying internal data, and naming victim organizations on dark-web leak sites. The group demanded cryptocurrency ransoms while threatening to publish the files; if victims refused to pay, it released the data for free.

The Swiss Federal Police stated that the group also used double-extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges show that Fouad Eltibrizi, a Dutch national residing in the United Kingdom and known by the alias Archduke, was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and is awaiting extradition. He faces up to 10 years in prison. Europol's European Cybercrime Centre is assisting with cryptocurrency fund tracing and digital forensics.

Key points

Evidence indicates that Spanish police arrested a 16-year-old Romanian national in Alicante, suspected of serving as KillSec's administrator and primary operator.
Two other suspects in their twenties were arrested in the United Kingdom and Romania; a developer whose identity was established this year August aged 18 was identified but not arrested.
Operation KillSwitch investigated approximately 1000 suspected attacks worldwide, of which approximately 500 were confirmed successful intrusions.
Law enforcement officers searched eight locations in Spain, Greece, Romania, and the United Kingdom, took control of five central servers, and seized at least 110 TB of stolen data.
Evidence alleges that KillSec has been active since around 2024 year, infiltrating corporate systems by exploiting software vulnerabilities and inadequate cloud-storage protection, and applying pressure through means including publicizing data, cryptocurrency ransoms, and encrypted servers.
Evidence alleges that Fouad Eltibrizi (alias Archduke) was, in September 16 indicted by U.S. prosecutors, subsequently arrested, and is awaiting extradition, facing up to 10 years in prison.
The European Cybercrime Centre is assisting with cryptocurrency fund tracing and digital forensics.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Ransomware groups typically first gain access to an organization’s systems, then copy or encrypt data, and subsequently demand that the victim pay a ransom. This article describes a law-enforcement operation involving multiple countries, but some content still constitutes allegations concerning suspects and the case.

Why it matters to readers

If the actions described in the evidence are genuine, corporate data breaches, ransomware, and the tracking of related cryptocurrency funds are all receiving law enforcement attention.

This shows that an organization’s cloud storage and software vulnerabilities can become entry points for intrusion, and that refusing to pay a ransom does not necessarily end the risk of data leakage.

Risks and unknowns

The evidence comes from Telegram reposts, and no links to original announcements from institutions such as Europol were provided.
Details in the article concerning the suspects’ identities, the number of attacks, the number of successful intrusions, and the volume of stolen data still cannot be independently verified.
The arrests, indictments, and alleged affiliations with the group described in the article do not constitute final court convictions.
The evidence does not indicate whether any specific amount of cryptocurrency has been traced, frozen, or seized.

Spain and Several Other Countries Target KillSec Ransomware Gang in Joint Operation; Servers and Domains Seized

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center