A 16-year-old and 110 terabytes

Spanish police have arrested a 16-year-old suspected of leading KillSec, a ransomware group, as part of an international operation that also took the group's leak site and servers, The Record reported on Thursday 1 October. The action was carried out on Wednesday 30 September, BleepingComputer reported, and the seized leak site now names Hamburg's State Criminal Police Office as the agency in control of it. Europol and Eurojust took part, alongside the security companies Bitdefender and Group-IB.

Europol said in its announcement that three suspects were arrested and eight searches carried out across four European countries, against a group linked to about 1,000 attacks worldwide. Quoting the release, BleepingComputer said: "Investigators identified a 16-year-old as the group's suspected main operator." It said the searches took place in Greece, Romania, Spain and the UK, and that at least 110 terabytes of stolen data were secured. Authorities in ten countries, including the US, Germany and the Netherlands, were involved, it reported.

The teenager was detained in Alicante and is a Romanian national, according to Reuters as cited by The Record. He has not been named. Hamburg police said investigators in several countries began looking at the group in early 2025 after a series of attacks, and have identified at least four suspected members, The Record reported. One, a suspected developer, turned 18 in August and was a minor when some of the alleged offences were committed, according to both outlets. BleepingComputer said the others are believed to include a negotiator and an affiliate.

The Record also reported that UK police arrested Fouad Eltibrizi, a Dutch national who allegedly uses the name "Archduke". He was indicted by a federal grand jury in the District of Puerto Rico on 16 September on a charge of "unauthorized computer access conspiracy", and is awaiting extradition to the US, The Record reported, citing the Justice Department. An indictment is an allegation. Neither report says whether his arrest is one of the three counted by Europol.

The seizures are the more concrete part of the operation. Investigators shut down five servers, including KillSec's main server, BleepingComputer reported. The dark-web leak site now carries a banner saying its domain, servers and data "have been taken into control by State Criminal Police Office of Hamburg" and international partners. Europol said KillSec received "substantial" ransom payments; neither outlet reports a figure for those payments or for any funds recovered. Investigators are examining seized devices and tracing alleged proceeds, including cryptocurrency.

The scale figures are provisional. Of the roughly 1,000 suspected attacks, around 500 are believed to have been successful, BleepingComputer reported, adding that the number could change; The Record put it as "at least half". At least 70 of the attacks are linked to German organisations, including 18 in Hamburg, which by our arithmetic is about 7 per cent of the total. KillSec has been active since about 2024, according to both outlets. It allegedly exploited software flaws and poorly secured edge devices before extorting victims through its leak site, BleepingComputer reported.

How much a single arrest dents the brand depends on how the business was built. The security company Halcyon says KillSec's ransomware-as-a-service offer ranked "among the most affordable", with a $250 entry fee, and that its Tor-accessible control panel provided statistics, chat and builder tools that lower technical barriers for less skilled attackers. That design puts a few people at the centre, among them the administrator and developer, while the attacks themselves were run by affiliates. Members also used artificial intelligence to help build the infrastructure and find victims, BleepingComputer reported; that finding is the authorities' and was not independently verified.

The reports leave several questions open: whether the teenager has been charged, whether affiliates have moved to other groups, and how much of the 110TB had already been published. For victims, the practical change is that the stolen data on the seized servers is now in police hands. Leak sites remain the pressure point in these cases, as Berlin found when Rhysida published files after the city refused to pay, and as IDC Frontier's customers are learning after an attack on its cloud, as we reported on Saturday.