16-Year-Old Suspected KillSec Ransomware Leader Arrested As Police Seize 110TB Of Stolen Data

KillSec Infrastructure Seized As Teen Suspected Of Leading Ransomware Group Is Arrested

A 16-year-old suspected of being the main operator of the KillSec ransomware group has been arrested in Spain as international authorities moved to take down the infrastructure behind around 1,000 suspected cyberattacks.

The operation also saw authorities seize five servers, take control of KillSec's leak site and secure at least 110 terabytes of stolen data, preventing the information from being accessed or published by the group.

Teen Suspected Of Running KillSec Arrested In Spain

The teenager, described by Europol as the suspected administrator and main operator of KillSec, was arrested in Alicante, Spain, on 30 September 2026.

Reuters reported that he is a Romanian national.

Two other suspects were also arrested, bringing the total number of provisional arrests to three, while police searched eight properties across Spain, Greece, Romania and the UK.

The investigation was led by German authorities through the Hamburg State Criminal Police Office and Hamburg Public Prosecutor's Office, with support from authorities across Europe and the US.

The operation involved Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK and the US, alongside Europol and Eurojust.

Cybersecurity firms Bitdefender and Group-IB also provided technical support during the investigation.

110TB Of Stolen Data Secured As Leak Site Falls

Authorities took control of KillSec's dark-web leak site and secured at least 110TB of data linked to victims.

The site had been used to name organisations that KillSec claimed to have attacked and threaten them with the release of stolen files if they did not pay a ransom.

Europol said authorities also took control of domains operated by the group and redirected visitors to a law-enforcement seizure notice.

Five central servers used to manage the operation and store stolen victim data were also brought under police control.

Investigators are now examining the seized devices, infrastructure and data as they work to identify additional victims, attacks and people involved in the operation.

How Did KillSec Carry Out Its Attacks?

KillSec emerged in 2024 and gained access to organisations by exploiting software vulnerabilities and poorly secured entry points, particularly in cloud environments.

After infiltrating systems, the group copied sensitive information and moved it to infrastructure under its control.

Victims were then listed on KillSec's leak site and threatened with the public release of their files unless they paid.

According to Europol, investigators are looking into around 1,000 suspected attacks linked to KillSec worldwide, with about 500 so far identified as successful.

Around 70 of the suspected attacks involved government organisations.

The number could change as investigators continue analysing evidence seized during the operation.

KillSec Used Ransomware Tools To Target Organisations

The group's model allowed other cybercriminals to use its ransomware services and tools, according to researchers tracking the operation.

Halcyon previously described KillSec as offering a relatively low-cost ransomware-as-a-service platform, with a Tor-based control panel, chat functions and custom ransomware tools that could allow attackers with limited technical skills to launch operations.

Bitdefender has tracked KillSec since 2024 and identified nearly 300 victims on its leak site.

The cybersecurity company said KillSec posted 126 victims in 2025 and 25 in 2026, with the latest victim appearing on 18 September, shortly before the law-enforcement operation.

Bitdefender researcher Alexandru Nicola Stoica said the group was "mostly opportunistic with its targets" and that the company did not have an estimate of victims' losses.

Investigators Also Found AI In KillSec's Operations

The investigation uncovered evidence that KillSec used artificial intelligence to help build and maintain its infrastructure and identify potential victims.

The finding adds another layer to an operation that already relied on cloud vulnerabilities, stolen data and dark-web infrastructure to carry out extortion.

Authorities had been investigating KillSec-linked attacks since early 2025, eventually identifying suspects believed to have taken on different roles within the group, including an administrator, developer, negotiator and affiliate.

One suspected developer turned 18 in August 2026 but was a minor when some of the alleged offences took place.

UK Arrest Linked To US Criminal Charges

The operation also led to the arrest in the UK of Dutch national Fouad Eltibrizi, who allegedly used the online name "Archduke".

The US Department of Justice indicted Eltibrizi on 16 September 2026 over an alleged role connected to the KillSec operation and charged him with conspiracy to commit unauthorised computer access.

UK authorities arrested him on 30 September and are preparing to extradite him to the US, where he will face the charges.

The investigation remains ongoing as authorities analyse the seized infrastructure, trace criminal proceeds and examine evidence that could lead to further suspects and victims.