Spanish police arrest 16-year-old suspected of running KillSec ransomware group

Spanish police arrested a 16-year-old Romanian national in Alicante who is suspected of being KillSec's main operator. A Europol spokesperson said the teenager is suspected of acting as the ransomware group's administrator. Police arrested two other people in their twenties, one in Britain and one in Romania. Investigators identified but did not arrest a fourth suspect, a developer who turned 18 in August and was a minor when some alleged offences occurred. The September 30 action was part of Operation KillSwitch, led by the Hamburg State Criminal Police Office and the city's public prosecutor. The investigation covers around 1,000 suspected attacks worldwide, about 500 of which have so far been identified as successful. Officers searched eight properties in Spain, Greece, Romania and the UK. Police took control of five central servers and redirected the group's domains to a seizure notice. Europol said authorities secured at least 110 terabytes of stolen data. Fouad Eltibrizi, the man arrested in Britain, is a Dutch national resident in the UK who used the handle Archduke. A federal grand jury in Puerto Rico indicted Eltibrizi on September 16 on charges involving conspiracy to access computers without authorization for financial gain, damaging protected computers and transmitting extortion threats. Eltibrizi was arrested during the following fortnight and faces extradition and a maximum penalty of 10 years. U.S. prosecutors say KillSec posted details of a Puerto Rico breach on its leak site in March 2025, alongside samples of stolen patient data and a seven-day countdown. Prosecutors say roughly 180GB of data were published after the company did not respond. The indictment describes similar breaches in California, Washington State and Louisiana. Europol said KillSec has been active since around 2024. Europol said the group exploited software vulnerabilities and poorly secured access points, particularly to cloud storage, to access organizations' systems and copy internal data. Europol said KillSec threatened to publish victims' data unless they paid and made files available for free download when they did not. Switzerland's federal police said the group also encrypted servers before threatening to publish data if a company declined to pay because it had backups. Ransoms were often demanded in cryptocurrency. Swiss prosecutors have been investigating since July 2025 over attacks on Swiss companies between October 2023 and June 2025. Investigators found that the group used AI to build and maintain its ransomware infrastructure and identify potential victims. Investigators are examining seized devices and tracing the group's proceeds, including cryptocurrency. Europol's European Cybercrime Centre supported that work with cryptocurrency tracing and digital forensics. Officers from the Eastern Region Special Operations Unit arrested a 25-year-old suspected of negotiating with victims at an address in Levenshulme, Manchester. Authorities have identified 28 victim companies in the UK. Detective Sergeant John Collinson of the unit's cyber crime team said ransomware causes significant financial losses, operational disruption and harm to public confidence.