GERMAN authorities have identified a 16-year-old Romanian national as the alleged mastermind of the KillSec ransomware operation, following a coordinated international takedown that led to the arrests of three suspects and searches of eight properties across Spain, Greece, Romania and the UK. In a Hamburg police statement, investigators said they also seized control of KillSec’s leak website and secured at least 110TB of data to prevent further access.
The operation, titled “Operation KillSwitch,” is described by Europol as an international sting that targeted both the individuals behind KillSec and the infrastructure they relied on.
Authorities from multiple countries, with Europol and Eurojust coordinating and Bitdefender and Group-IB providing technical support, raided eight homes and took five servers and other infrastructure offline. Reuters reports the teenager—described as the group’s administrator—was arrested in Alicante, Spain.
Separately, the US Justice Department indicted a Dutch national over related activity, and UK police arrested Fouad Eltibrizi in connection with the case; he faces extradition to the United States on charges of unauthorised computer access conspiracy. KillSec has been active since 2024, opportunistically exploiting known vulnerabilities and weak cloud security to access enterprise networks and exfiltrate data, often naming victims on its leak site.
Bitdefender notes the group posted about 126 victims in 2025 and 25 in 2026, though leak-site tallies do not necessarily reflect actual losses. About 500 confirmed KillSec attacks have been linked to the takedown, with around 70 affecting government organisations.