Teen suspected of running KillSec ransomware group as cops seize servers, arrest three
READ MORE
- Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows1 day ago
- OpenAI alerts 100+ orgs that its 'misaligned models' attempted to break in - or worse2 days ago
- OpenAI's wandering AI agents earn it a California subpoena2 days ago
- Fortinet sounds the alarm over actively exploited FortiMail zero-day2 days ago
- Met Police suspends use of phone-hacking software over Russian links2 days ago
-
AI models keep posting screenshots showing sensitive data from inside tech companies
-
Stanford prof is beating the drum for a new protocol to replace TCP
-
EXCLUSIVE Microsoft tells nonprofits their deleted M365 data isn't coming back
-
Google ending ChromeOS support two years early
-
Teen suspected of running KillSec ransomware group as cops seize servers, arrest three
-
Microsoft makes Windows settings backup the default in 26H2 - Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows Exploitation attempts came from China-hosted IP, VulnCheck researcher says
- Power approval set to delay Oracle's Wisconsin AI datacenter Grid connection awaits regulatory approval, putting planned 2027 customer delivery at risk
- Nvidia debuts $4,999 DGX Spark with half the RAM and storage, amid memory crunch Meanwhile 128 GB version jumps to $6,950, nearly 75% above its launch price
- Pi coding agent pulls a 180 and adds MCP support To maintain minimalism, a new harness layer has been folded into a separate component
- Stanford prof is beating the drum for a new protocol to replace TCP Homa is a rethink of networks for the AI age
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- Revive Raskin's 3 laws of software with humane work that considers a dev's duty of care All this, and angry NeoVim users Firefox 157: Could bold new look be just what Mozilla needs?\ Yet another new version of Firefox, with a significant reskin
- KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user
- Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term home'
- Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push
- Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin
Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide.
Authorities announced on Thursday that an international operation had seized the group's infrastructure and made three provisional arrests. The German-led Operation KillSwitch replaced the crew's leak site with a police seizure notice.
The available information is incredibly fragmented. Europol said the 16-year-old was "the group's suspected main operator," but did not explicitly say this person was arrested.
REG AD
Spanish police announced the arrest of a "minor," a Romanian national residing in Spain, but did not publicly link this arrest to the 16-year-old mentioned by Europol.
REG AD
The US Department of Justice (DoJ) said UK police had arrested Dutch national Fouad Eltibrizi, whom it has charged over alleged cybercrimes in the US and Puerto Rico. It is seeking his extradition.
Eltibrizi is the only suspect officials have publicly named. Europol told The Register he was allegedly one of KillSec's negotiators.
Authorities have not named the suspected 16-year-old operator.
Romanian police (Poliția Română) said a 24-year-old helped establish KillSec in October 2023, although other authorities date the group's formation to 2024. Their statement did not specify whether that person was arrested.
Officials separately confirmed to The Register that a Romanian national in his twenties was arrested in Romania on suspicion of acting as a KillSec affiliate.
Operation KillSwitch splash page
Europol
Europol also identified a suspected developer who turned 18 in August and was a minor when some of the alleged offenses were committed.
Spanish police referenced a woman who remains under investigation in connection to the case, but was not arrested.
The coordinated raids took place on September 30, following investigations that began in early 2025.
REG AD
Ten police agencies from Europe and the US took part, with officers raiding eight properties across Greece, Romania, Spain, and the UK.
Spanish police said officers raided a home and an office in an Alicante hotel, while Poliția Română searched four homes. Neither Greece nor the UK has released information about their involvement in the operation.
Authorities secured at least 110 TB of data on KillSec's leak site against further unauthorized access. Investigators are examining seized devices and data to identify victims, attacks, and suspects, and trace the group's criminal proceeds.
Over the course of the investigation, police took control of five central servers used to manage the group's activities and store victims' data.
Officer carrying seized devices
Europol
Security shops Bitdefender and Group-IB also supported the investigation.
KillSec uses double extortion, encrypting victims' systems and threatening to publish stolen data unless they pay.
Group-IB recently included KillSec, also referred to as "Kill Security" and "k1llsec," in its 2025 top 10 rankings for ransomware groups operating in APAC, LATAM, and the Middle East.
The company's researchers said KillSec most commonly preyed on financial services and healthcare organizations, but was known to attack government entities and large enterprises.
REG AD
Group-IB said KillSec also offered stolen data for sale at prices ranging from $5,000 to $500,000.
"Servers can be replaced in weeks; the people who build the platform and approve every attack cannot," said Group-IB CEO Dmitry Volkov. "Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end."
KillSec initially offered a Windows encryptor before adding a version capable of encrypting VMware ESXi hosts, deleting data, shutting down VMs, and removing recovery points. ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784) [](https://bsky.app/intent/compose?text=Teen%20suspected%20of%20running%20KillSec%20ransomware%20group%20as%20cops%20seize%20servers%2C%20arrest%20three%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784&title=Teen%20suspected%20of%20running%20KillSec%20ransomware%20group%20as%20cops%20seize%20servers%2C%20arrest%20three) [](https://api.whatsapp.com/send?text=Teen%20suspected%20of%20running%20KillSec%20ransomware%20group%20as%20cops%20seize%20servers%2C%20arrest%20three%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F10%2F02%2Fteen-suspected-of-running-killsec-ransomware-group-as-cops-seize-servers-arrest-three%2F5300784)
REG AD
The VMware exit is a protection upgrade PARTNER CONTENT: VergeIO says an exit is also an opportunity