Spanish police arrested a 16-year-old boy involved in operating the KillSec ransomware group
According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.
