Spanish Police Arrest 16-Year-Old Accused of Running KillSec Ransomware Group

What it is

KillSec takedown (Operation KillSwitch), led by the Hamburg State Criminal Police Office's prosecutor and the FBI's San Juan field office, investigating roughly 1,000 suspected attacks worldwide, about 500 confirmed successful. The summary names the arrests and the 110TB seizure; the page adds the suspect roster, the legal mechanics of one prosecution, and victim-count detail by country.

How it works

KillSec ran double extortion: encrypt servers, then threaten publication if the victim relied on backups instead of paying, with ransoms typically demanded in cryptocurrency. Entry came via software vulnerabilities and poorly secured access points, especially misconfigured cloud storage, after which data was copied to attacker-controlled infrastructure. Victims were named on a dark web leak site with a countdown before files were dumped for free download.

Preconditions / Affected

A fourth suspect — the group's developer, who turned 18 in August 2026 but was a minor when some offenses occurred — has been identified but not arrested, leaving part of the infrastructure's authorship unresolved. The UK has identified 28 victim companies; Switzerland's federal police have investigated attacks on Swiss companies between October 2023 and June 2025. The US indictment (Fouad Eltibrizi, alias "Archduke," Dutch national resident in the UK, indicted by a federal grand jury in Puerto Rico on September 16, charged with conspiracy to access computers without authorization for financial gain, damaging protected computers, and transmitting extortion threats, max penalty 10 years) cites specific breaches: a Puerto Rico healthcare target where ~180GB of patient data was published in March 2025 after a seven-day countdown went unanswered, plus similar breaches in California, Washington State, and Louisiana.

flowchart TD
    A[Breach via cloud misconfig] --> B[Data copied + servers encrypted]
    B --> C[Leak site countdown posted]
    C -->|Victim pays| D[No publication]
    C -->|Victim doesn't pay| E[Data dumped free]
    E --> F[Puerto Rico healthcare: 180GB released Mar 2025]

What to do

Five central KillSec servers are now under police control; domains redirect to a seizure notice. Investigators (supported by Europol's European Cybercrime Centre crypto-tracing and digital forensics unit) are still tracing proceeds, including cryptocurrency, from seized devices — organizations that paid KillSec ransoms in crypto may be relevant to this ongoing tracing and could be contacted by investigators.

Caveats

The developer-suspect remains unarrested, so KillSec's tooling/infrastructure may still have an active maintainer at large. The extradition of Eltibrizi is pending, not concluded, and the cryptocurrency tracing is described as ongoing rather than complete.