Police in Europe and the United States have dismantled the KillSec ransomware and extortion operation and identified a 16-year-old as its administrator and main operator, SecurityWeek reported Thursday. The action, called Operation KillSwitch, took over the group's dark web leak site and core infrastructure and led to three provisional arrests.

What Happened

Law enforcement agencies from 10 countries took part: Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the U.K. and the U.S. BleepingComputer reported that the investigation was led by police in Hamburg, Germany, with Europol and Eurojust supporting it. Security companies Bitdefender and Group-IB also assisted.

Officers searched eight homes in Greece, Romania, Spain and the U.K. and seized five servers allegedly used to run the group and store stolen data, according to The Record. The suspected leader, a Romanian national, was arrested in Alicante, Spain, The Record said; his name has not been released.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

Investigators also identified a suspected developer who, according to Europol, committed multiple offenses before turning 18 in August, along with an alleged negotiator and an affiliate. Other members remain under investigation.

Separately, Fouad Eltibrizi, a Dutch national who used the alias "Archduke," was arrested in the U.K. on Sept. 30. A federal grand jury in Puerto Rico indicted him Sept. 16 on a charge of conspiracy to commit unauthorized computer access, and he is awaiting extradition to the U.S. CyberScoop reported that prosecutors accuse him of placing extortion calls as a negotiator for the group between March and November 2025 and that the charge carries up to 10 years in prison.

Why It Matters

Authorities attribute about 1,000 attacks worldwide to KillSec since it surfaced around 2024, and say roughly 500 of them succeeded. Before the takedown, the group's leak site listed about 450 victims. Police said they secured at least 110 terabytes of stolen data, a volume that should help them notify organizations that may not know they were hit.

The Record said the group broke into victims largely by exploiting weaknesses in cloud storage, copied sensitive files and then threatened to publish them unless a ransom was paid. Victims included health care providers, government bodies and financial services companies. CyberScoop named several U.S. victims cited by prosecutors, among them Instituto de Ojos in Puerto Rico, U.S. BioTek Laboratories in Washington state and Accelerated Academy in Louisiana. BleepingComputer reported that at least 70 attacks hit German organizations, 18 of them in Hamburg.

The case adds to a run of arrests involving teenagers in data-extortion crews, where low-cost access to cloud data and leak-site tactics have allowed small, young groups to cause outsized damage. The FBI's Cyber Division said the operation had degraded the group's core capabilities.

How the Group Operated

SecurityWeek said KillSec combined exploitation of software vulnerabilities with abuse of weakly protected cloud storage and poorly secured devices to get in. The group also worked with affiliates, and investigators counted at least one among the suspects identified. That structure, with a teenage administrator, a separate developer, a negotiator and affiliates, mirrors the division of labor seen in larger ransomware-as-a-service brands, even though police say two of its key members were minors when the alleged crimes took place.

What to Watch

Investigators are now examining seized computers and servers, tracing cryptocurrency and other criminal proceeds, and combing the recovered data for additional victims and suspects. Eltibrizi's extradition proceedings in Britain are the next court step in the U.S. case. Whether charges follow for the other identified suspects, including the two who were minors at the time of the alleged crimes, will depend on prosecutors in several countries, each with its own rules for juvenile defendants.