KillSec Ransomware Dismantled: Teen Administrator Arrested in Spain as U.S. Indicts Key Operator

A 16-year-old Romanian national suspected of running the KillSec ransomware group was arrested in Alicante, Spain, on September 30, marking the collapse of a cybercriminal operation responsible for roughly 500 successful intrusions worldwide. The teenager allegedly served as the primary administrator for the syndicate, which leveraged artificial intelligence to build its infrastructure and identify targets.

The takedown, designated Operation KillSwitch, was coordinated by the Hamburg State Criminal Police Office and the city’s public prosecutor. Investigators across Europe seized five central servers, redirected the group’s domains to law enforcement seizure notices, and secured at least 110 terabytes of stolen data. Eight properties were searched simultaneously in Spain, Greece, Romania, and the United Kingdom.

KillSec emerged around 2024, rapidly establishing itself through aggressive double extortion tactics. Rather than relying solely on encrypting victim networks—a method increasingly mitigated by modern backup protocols—the group prioritized exfiltrating sensitive internal data from poorly secured cloud storage environments. Victims who refused to pay cryptocurrency ransoms saw their files published for free download on the group’s dark web leak site.

The operational footprint extended directly into the United States, triggering federal charges. Fouad Eltibrizi, a 25-year-old Dutch national residing in Levenshulme, Manchester, was indicted by a federal grand jury in Puerto Rico on September 16. Operating under the handle Archduke, Eltibrizi faces charges of conspiracy to access computers without authorization for financial gain, damaging protected computers, and transmitting extortion threats. He carries a maximum potential sentence of 10 years in federal prison pending extradition.

U.S. prosecutors outlined a pattern of targeting American healthcare and corporate infrastructure. In March 2025, KillSec posted a breach involving a Puerto Rican entity on its leak site, publishing samples of stolen patient data alongside a seven-day payment countdown. When the organization failed to comply, the group released approximately 180 gigabytes of information. The indictment details similar attacks against victims in California, Washington State, and Louisiana.

British authorities arrested Eltibrizi two weeks after his indictment, suspecting him of handling direct negotiations with victims. The Eastern Region Special Operations Unit has identified 28 compromised companies within the UK alone.

Two additional suspects remain in the crosshairs of European investigators. A second individual in their twenties was detained in Romania during the September 30 raids. Authorities have also identified a fourth suspect—a developer who operated as a minor during several offenses but turned 18 in August—though no arrest has been made in that case yet.

The use of artificial intelligence by KillSec represents an accelerating trend in ransomware operations. Threat actors are increasingly utilizing large language models and automated coding tools to refine malware payloads, maintain command-and-control architecture, and parse open-source intelligence for vulnerable targets faster than traditional manual reconnaissance allows. This automation lowers the barrier to entry, enabling younger operators like the 16-year-old administrator to manage complex global campaigns.

Europol’s European Cybercrime Centre provided specialized digital forensics and cryptocurrency tracing to support the investigation. Financial tracking remains a central pillar of the ongoing inquiry, as prosecutors attempt to follow the flow of ransom payments through blockchain networks to recover proceeds and identify downstream money launderers.

Swiss federal police confirmed parallel investigations into KillSec dating back to July 2025, focusing on a series of attacks against Swiss companies executed between October 2023 and June 2025. Forensic examination of the seized devices is currently underway across all participating jurisdictions.