Spain arrests 16-year-old as police dismantle KillSec ransomware gang

Police in Spain arrested a 16-year-old Romanian national suspected of running the KillSec ransomware gang on 30 September 2026, as an international operation seized the group's leak site and servers and made three arrests in total. Europol said investigators identified the teenager as the gang's suspected main operator, while searches took place in Greece, Romania, Spain and the United Kingdom.bleepingcomputer.com+1

The takedown matters because KillSec, also known as Kill Security or k1llsec, emerged in 2024 and grew into a significant ransomware-as-a-service operation that recruited affiliate hackers and targeted hospitals, government bodies and financial institutions. Group-IB identified at least 274 publicly disclosed victims, with the United States accounting for around 35% of them, Europe about 14% and the United Kingdom roughly 3%.computerweekly.com

What Operation KillSwitch seized

Operation KillSwitch, led by German authorities, involved police from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland and the United Kingdom, with Europol and Eurojust taking part alongside cybersecurity companies Bitdefender and Group-IB. Europol said the investigation covered around 1,000 suspected attacks worldwide and began in 2025.

Hamburg Police said they investigated the gang's server infrastructure, identifying and shutting down five servers, including KillSec's main server and servers allegedly used to store stolen data. One seized site was KillSec's dark web data leak site, which now displays a seizure banner stating the domain, servers and associated data are under the control of the State Criminal Police Office of Hamburg and international law enforcement agencies.

The Spanish arrest was carried out by Spain's Guardia Civil and Catalan authorities after searches at two addresses in Alicante, one a private home and the other a hotel. Guardia Civil officers seized computer equipment, mobile phones, cryptocurrency wallets and tools designed to mask the gang's activities. Europol said three suspects were provisionally arrested and eight properties searched across four countries.

Who the arrests named

Europol said the suspected administrator and main operator of KillSec is 16 years old. Another suspected member, described as a developer, turned 18 in August 2026 and was still a minor when some of the alleged crimes were committed. Authorities also identified individuals suspected of being a negotiator and an affiliate. One arrest in the United Kingdom was of a Dutch national named in a US Department of Justice indictment as Foaud Eltibrizi, also known as Archduke.

KillSec's attacks followed a path of least resistance, according to Group-IB: phishing, brute-force attacks on exposed Remote Desktop Protocol services, known vulnerabilities in internet-facing applications, and misconfigured cloud storage vaults. The gang initially favoured Windows environments and began targeting VMware ESXi hosts in November 2024. Investigators also found members used artificial intelligence to help build and maintain ransomware infrastructure and identify potential victims.

How KillSec broke into systems

Europol said around 500 of KillSec's attacks were successful, while authorities cautioned the numbers could change as analysis of seized evidence continues. At least 70 suspected attacks are linked to organisations in Germany, including 18 cases connected to Hamburg. Europol said KillSec received substantial ransom payments.

Authorities are now examining seized computers, servers and other data while attempting to trace KillSec's alleged criminal proceeds, including cryptocurrency. Investigators say the seized evidence could reveal further victims, attacks and people involved with the ransomware operation. The identities of other alleged members have not been revealed, and additional investigations into other potential gang members continue.