KillSec's 16-Year-Old Admin Busted; 110TB of Cloud Loot Now in Cuffs 🚨

Spanish police have arrested a 16-year-old Romanian national in Alicante suspected of serving as the main administrator of the KillSec ransomware group, Europol said on October 1. The teenager is alleged to have run the group's operations as authorities in Spain, Britain, and Romania detained three people in total and identified a fourth, a developer who turned 18 in August. The September 30 action, part of Operation KillSwitch led by Germany's Hamburg State Criminal Police Office and the city's public prosecutor, targeted roughly 1,000 suspected attacks worldwide, of which about 500 have so far been identified as successful. Eight properties were searched across Spain, Greece, Romania, and the UK.

Law enforcement seized KillSec's leak site and secured at least 110 terabytes of stolen data, the FBI San Juan Cyber Division confirmed in a separate announcement. The agency said it took control of the infrastructure to prevent further publication. KillSec, active since around 2024, exploited software vulnerabilities and poorly secured cloud storage access points to copy internal data onto infrastructure it controlled, Europol said. Victims were named on its dark web leak site and threatened with publication unless they paid, with files released for free download where no payment came.

U.S. prosecutors say KillSec posted a Puerto Rico breach on its leak site in March 2025, publishing samples of stolen patient data and a seven-day countdown; roughly 180GB were released when the company did not respond. A federal grand jury in Puerto Rico indicted Fouad Eltibrizi, a Dutch national resident in the UK who used the handle Archduke, on September 16 on charges including conspiracy to access computers without authorization for financial gain, damaging protected computers, and transmitting extortion threats. Eltibrizi was arrested the following fortnight in Britain and faces extradition, with a maximum penalty of 10 years.

Switzerland's federal police said KillSec used a double-extortion model, encrypting servers and then threatening to publish stolen data when companies declined to pay because they had backups, with ransoms often demanded in cryptocurrency. Swiss prosecutors have been investigating since July 2025 over attacks on Swiss companies between October 2023 and June 2025. The indictment describes similar breaches in California, Washington State, and Louisiana. A Europol spokesperson confirmed to Reuters that the 16-year-old is suspected of acting as the group's administrator.