Spanish police arrest teen linked to KillSec ransomware operation

Operation KillSwitch targets core infrastructure

European police, led by Hamburg’s State Criminal Police Office, executed Operation KillSwitch on 30 September, searching eight properties across Spain, Greece, Romania and the UK. The raid secured five central servers and redirected associated domains to seizure notices. Europol confirmed that at least 110 TB of stolen data were recovered, preventing further publication on KillSec’s leak site.

Spanish authorities detained a 16-year-old Romanian national in Alicante, identified by Europol as the group’s administrator. Two additional suspects in their twenties were arrested—one in Britain and one in Romania. A fourth individual, a developer who turned 18 in August, has been identified but not apprehended. In the UK, a 25-year-old was arrested for negotiating with victims, while a Dutch national residing in the UK, Fouad Eltibrizi (handle “Archduke”), was indicted by a Puerto Rican grand jury on 16 September and arrested two weeks later; he now faces extradition with a potential ten-year sentence.

Crypto proceeds and AI tools under scrutiny

KillSec’s ransom demands were predominantly in cryptocurrency. Europol’s European Cybercrime Centre, assisted by specialist crypto-tracing and digital forensics teams, is examining seized devices to follow the financial flows. Swiss prosecutors, investigating attacks on local firms from October 2023 to June 2025, noted the group’s use of AI to construct and maintain its ransomware infrastructure and to profile targets.

Impact on victims and broader cybercrime landscape

The group’s double-extortion model encrypted victim servers and threatened public release of data, releasing up to 180 GB of patient information from a Puerto Rico breach when payment was not received. In the UK, Detective Sergeant John Collinson highlighted the “significant financial losses, operational disruption and harm to public confidence” caused by the attacks, which affected 28 identified companies. The operation’s success demonstrates the growing capacity for coordinated international action against ransomware actors that blend traditional extortion with emerging technologies.