Teen Ringleader of KillSec Ransomware Group Arrested in International Police Operation

Spanish police have arrested the suspected 16-year-old leader of the KillSec ransomware group, a Romanian national detained in Alicante, as part of a coordinated international crackdown. Authorities raided eight properties across Greece, Romania, Britain and Spain, seizing five servers used to manage the group's operations and stolen data. Two additional arrests were made, including Dutch national Fouad Eltibrizi, who is awaiting extradition to the United States after being indicted by a federal grand jury in Puerto Rico.

KillSec emerged in 2024 and is believed to have carried out around 1,000 attacks, with at least half succeeding. The group exploited vulnerabilities, particularly in cloud storage systems, to break into networks and steal sensitive data, then listed victims on a leak site and extorted them with threats to publish the information. Investigators in Hamburg began tracking the group in early 2025 and have identified at least four suspected members, with further investigations ongoing.

According to cybersecurity firm Halcyon, KillSec ran one of the cheapest ransomware-as-a-service platforms available, offering a Tor-based control panel with chat support and ready-made tools that let low-skilled criminals launch attacks. Victims spanned healthcare, government and financial services sectors. The operation involved Europol's cybercrime centre along with police forces from nine countries and cybersecurity firms BitDefender and Group-IB.