Law enforcers have struck at a prolific ransomware group thought to be responsible for hundreds of cyber-attacks, arresting its 16-year-old suspected ringleader.
KillSec has been in operation since 2024 and carried out at least 500 successful attacks in that time, although it is responsible for twice that number, according to Europol.
Led by German police, Operation KillSwitch saw law enforcers seize the group’s leak site and prevent at least 110TB of stolen data from being exposed, it explained.
In total, police claimed five servers that were used to manage the group’s activities and store data taken from victims, as well as domains operated by KillSec which are now redirecting visitors to a police seizure notice.
Read more on KillSec: KillSec Ransomware Hits Brazilian Healthcare IT Vendor
The RaaS outfit targeted organizations by exploiting software vulnerabilities and poorly secure cloud storage access points, according to Europol.
Group-IB, which was involved in the operation, identified 274 publicly claimed victims, most of which were US (35%) and Indian (17%) organizations.
Although the group used Windows and VMware ESXi virtualization lockers, it didn’t always encrypt; stealing and extorting data on some occasions. It apparently acted as both a ransomware operator and data broker, advertising stolen data for sums ranging from $5000 to $500,000.
KillSec's operations depended on a small core team that developed the locker and approved each build, Group-IB claimed.
Arrests Target Key Members
Authorities carried out eight house searches in Spain, Greece, Romania, and the UK, seized evidence and assets, and made three provisional arrests, including a 16-year-old thought to be the administrator and main operator.
According to reports, the individual is a Romanian national who was arrested in the Spanish city of Alicante.
Others include a suspected developer who turned 18 in August 2026. Investigators also identified a third individual believed to have been a negotiator and another who was an affiliate.
“KillSec's affiliates went after the organizations people depend on most: hospitals, government bodies, and financial institutions,” said Group-IB CEO, Dmitry Volkov.
“Closing the gaps these groups exploit is essential, but it does not end an operation like this. Servers can be replaced in weeks; the people who build the platform and approve every attack cannot. Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end.”
To that end, US authorities have announced the indictment of a Dutch national living in the UK on charges related to KillSec.
Fouad Eltibrizi (aka Archduke), was arrested on September 30 by British police and is charged with hacking and extortion-related offenses that carry a maximum sentence of 10 years behind bars.