Teenagers suspected of leading KillSec ransom group arrested during international operation

DataBreaches has reported on a group known as KillSec for almost two years. This time, we get to report on their arrest.

The European Union Agency for Criminal Justice Cooperation issued this press release today:

An international group of authorities from nine countries, coordinated by Eurojust and Europol, has successfully shut down a ransomware group responsible for almost 1 000 attacks worldwide. During the investigation, a 16-year-old was identified as the group’s main operator. The group, known as KillSec, stole sensitive data and threatened to publish the files unless a ransom was paid. KillSec has been around since 2024. By exploiting poorly secured access points, particularly those linked to cloud storage, the group was able to gain access to organisations’ systems. Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download. To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments. Authorities have identified other suspects in different roles, including administrator, developer, negotiator and affiliate. A teenager is suspected of being the group’s administrator and main operator. Other suspects include a developer who recently turned 18 and was a minor when a number of the alleged offences were committed. The group made itself known online by using aliases concealing their true identities. To communicate they used encrypted messaging services. Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States. A joint investigation team was set up at Eurojust between authorities from Belgium, Germany, Greece and Romania. All nine authorities worked together to identify suspects, locate the group’s infrastructure and follow financial trails. The authorities came together at Eurojust to plan an international action day involving the identification of suspects and the seizure of evidence and assets. The action day was run from a coordination centre set up at Eurojust. Europol produced reports on the group’s activities, connected investigators with private-sector partners and provided specialist support to trace cryptocurrency and examine digital evidence. The action day resulted in the arrests of three suspects and the seizure of evidence and assets. Eight house searches were carried out in Spain, Greece, the United Kingdom and Romania. They were able to secure at least 110 terabytes of stolen data. During the investigation, authorities seized five servers used by the group to store data from its victims. Authorities also seized domains operated by KillSec. The actions were carried out by the following authorities: Belgium : Public Prosecutor’s Office Brussels; Federal Computer Crime Unit Finland : National Bureau of Investigation Germany : Public Prosecutor’s Office Hamburg; Federal Criminal Police Office; Hamburg State Criminal Police Office Greece : Judicial authorities; Hellenic Police Romania : Prosecution Office attached to the High Court of Cassation and Justice, Directorate for Investigation of Organised Crime and Terrorism – Central Office; Romanian Police – Directorate for Combating Organised Crime Spain : Investigative Court number 20 of Barcelona; Public Prosecutor’s Office Barcelona; Mossos d’Esquadra; Guardia Civil Switzerland : Office of the Attorney General of Switzerland (OAG); Federal Office of Police fedpol United Kingdom : Eastern Region Special Operations Unit (ERSOU) United States : United States Attorney’s Office for the District of Puerto Rico; Federal Bureau of Investigation, San Juan Field Office

An international group of authorities from nine countries, coordinated by Eurojust and Europol, has successfully shut down a ransomware group responsible for almost 1 000 attacks worldwide. During the investigation, a 16-year-old was identified as the group’s main operator. The group, known as KillSec, stole sensitive data and threatened to publish the files unless a ransom was paid.

KillSec has been around since 2024. By exploiting poorly secured access points, particularly those linked to cloud storage, the group was able to gain access to organisations’ systems. Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download. To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments.

Authorities have identified other suspects in different roles, including administrator, developer, negotiator and affiliate. A teenager is suspected of being the group’s administrator and main operator. Other suspects include a developer who recently turned 18 and was a minor when a number of the alleged offences were committed. The group made itself known online by using aliases concealing their true identities. To communicate they used encrypted messaging services.

Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States. A joint investigation team was set up at Eurojust between authorities from Belgium, Germany, Greece and Romania. All nine authorities worked together to identify suspects, locate the group’s infrastructure and follow financial trails. The authorities came together at Eurojust to plan an international action day involving the identification of suspects and the seizure of evidence and assets. The action day was run from a coordination centre set up at Eurojust.

Europol produced reports on the group’s activities, connected investigators with private-sector partners and provided specialist support to trace cryptocurrency and examine digital evidence.

The action day resulted in the arrests of three suspects and the seizure of evidence and assets. Eight house searches were carried out in Spain, Greece, the United Kingdom and Romania. They were able to secure at least 110 terabytes of stolen data. During the investigation, authorities seized five servers used by the group to store data from its victims. Authorities also seized domains operated by KillSec.

The actions were carried out by the following authorities:

Belgium : Public Prosecutor’s Office Brussels; Federal Computer Crime Unit

Finland : National Bureau of Investigation

Germany : Public Prosecutor’s Office Hamburg; Federal Criminal Police Office; Hamburg State Criminal Police Office

Greece : Judicial authorities; Hellenic Police

Romania : Prosecution Office attached to the High Court of Cassation and Justice, Directorate for Investigation of Organised Crime and Terrorism – Central Office; Romanian Police – Directorate for Combating Organised Crime

Spain : Investigative Court number 20 of Barcelona; Public Prosecutor’s Office Barcelona; Mossos d’Esquadra; Guardia Civil

Switzerland : Office of the Attorney General of Switzerland (OAG); Federal Office of Police fedpol

United Kingdom : Eastern Region Special Operations Unit (ERSOU)

United States : United States Attorney’s Office for the District of Puerto Rico; Federal Bureau of Investigation, San Juan Field Office

The U.S. Attorney’s Office for the District of Puerto Rico announced the arrest of one of the members yesterday. From the announcement :

On September 16, 2026, a federal grand jury in the District of Puerto Rico returned an indictment charging a Dutch national who resides in the United Kingdom with conspiracy to intentionally access a computer without authorization for financial gain, intentionally causing damage without authorization to a protected computer, and intentionally transmitting a threat to obtain information from a protected computer without authorization with the intent to extort. The Dutch national named in the indictment, Fouad Eltibrizi (a/k/a Archduke), was arrested on September 30, 2026, in the United Kingdom. According to court documents, from at least March 2025 to November 2025, Eltibrizi and co-conspirators (forming what is known as the Kill Security Ransomware Group (“KillSec”)) targeted and gained access to victims’ computers through the exploitation of different vulnerabilities. KillSec would then exfiltrate (steal) the victims’ data (often sensitive business or client information) and store it on an exfiltration server abroad. A portion of the data would be published on the dark web (on KillSec’s leak site) and then the victims would be contacted with a ransom demand which, if not complied with, would result in the full publication or sale of the data on the dark web. In March 2025, KillSec posted on their leak site that they had breached a victim in Puerto Rico. KillSec gave the company a seven-day countdown to meet their ransom demands. The post on the leak site contained samples of stolen patient data. The victim did not respond to the demands made by KillSec, which then released approximately 180 gigabytes of stolen victim data on the dark web. The indictment also describes similar breaches in other locations on the mainland of the United States, such as California, Washington State, and Louisiana.

On September 16, 2026, a federal grand jury in the District of Puerto Rico returned an indictment charging a Dutch national who resides in the United Kingdom with conspiracy to intentionally access a computer without authorization for financial gain, intentionally causing damage without authorization to a protected computer, and intentionally transmitting a threat to obtain information from a protected computer without authorization with the intent to extort. The Dutch national named in the indictment, Fouad Eltibrizi (a/k/a Archduke), was arrested on September 30, 2026, in the United Kingdom.

According to court documents, from at least March 2025 to November 2025, Eltibrizi and co-conspirators (forming what is known as the Kill Security Ransomware Group (“KillSec”)) targeted and gained access to victims’ computers through the exploitation of different vulnerabilities. KillSec would then exfiltrate (steal) the victims’ data (often sensitive business or client information) and store it on an exfiltration server abroad. A portion of the data would be published on the dark web (on KillSec’s leak site) and then the victims would be contacted with a ransom demand which, if not complied with, would result in the full publication or sale of the data on the dark web.

In March 2025, KillSec posted on their leak site that they had breached a victim in Puerto Rico. KillSec gave the company a seven-day countdown to meet their ransom demands. The post on the leak site contained samples of stolen patient data. The victim did not respond to the demands made by KillSec, which then released approximately 180 gigabytes of stolen victim data on the dark web. The indictment also describes similar breaches in other locations on the mainland of the United States, such as California, Washington State, and Louisiana.

Updated at 3:45 PM to include the DOJ announcement.

The Eurojust press release confirmed what DataBreaches reported in 2024 the group finding exposed data and then attempting to extort victims it .

For other coverage on DataBreaches.net, see the Related posts below.