Securify

An international law enforcement operation spanning ten countries has dismantled KillSec, one of the most prolific ransomware-as-a-service groups of the past two years — and revealed that its suspected mastermind is a 16-year-old from Spain.

The coordinated takedown, dubbed Operation KillSwitch, culminated on September 30 when authorities arrested three suspects, seized five servers and over 110 terabytes of stolen data, and took control of KillSec’s dark-web leak site. The operation was led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor’s Office in Germany, with support from Europol, Eurojust, the FBI’s San Juan Field Office, and law enforcement agencies from Spain, the United Kingdom, Romania, Greece, Belgium, Finland, and Switzerland.

From Hacktivism to Ransomware Empire

KillSec’s trajectory tracks a pattern that has become disturbingly common in the cybercrime ecosystem. The group first surfaced in 2021 as a hacktivist collective before pivoting to financially motivated ransomware operations in October 2023. By June 2024, they had launched a full ransomware-as-a-service (RaaS) platform, offering affiliates a Windows-based encryptor for a $250 entry fee and an initial 12-percent share of any ransom collected. By January 2025, the group had raised its affiliate cut to 20 percent, and in November 2024 it introduced a VMware ESXi locker — expanding its reach from Windows endpoints into enterprise hypervisor environments.

The group’s business model was versatile. KillSec operated as both a ransomware operator and a data broker, demanding between $5,000 and $500,000 for stolen datasets. Victims who refused to pay saw their data published on the group’s leak site for free download. In many cases, KillSec sent data samples to victims as proof of compromise before opening ransom negotiations through encrypted messaging channels.

A Teenager at the Helm

The most striking revelation from Operation KillSwitch is the age of KillSec’s suspected administrator and main operator: a 16-year-old arrested at his home in Alicante, Spain. Spanish authorities from the Guardia Civil and Mossos d’Esquadra carried out the arrest, confiscating computer equipment, mobile phones, and cryptocurrency wallets containing transactions that investigators say match ransom payments from victims.

Two other suspects were also apprehended. Fouad Eltibrizi, a Dutch national, was arrested in the United Kingdom by the Eastern Region Special Operations Unit and now faces extradition to the United States, where he has been indicted in Puerto Rico on conspiracy charges related to unauthorized computer access — carrying a potential sentence of up to ten years. A third suspect, described as a developer who turned 18 just weeks before the arrests in August 2026, was also taken into custody. Investigators identified distinct roles within the group including administrator, developer, negotiator, and affiliate.

Eight properties were searched across Spain, Greece, the United Kingdom, and Romania as part of the coordinated sweep.

Scale of Damage

The numbers behind KillSec’s operation are staggering. Authorities believe the group was responsible for approximately 1,000 attacks worldwide, with around 500 confirmed as successful compromises. The financial services and healthcare sectors bore the brunt of the group’s campaigns, though government bodies, insurers, investment firms, and enterprises across multiple verticals were also hit.

Geographically, the United States accounted for 35 percent of identified victims, followed by India at 17 percent. Australia, Brazil, Colombia, and the United Kingdom each represented roughly three percent. By region, North America made up 35 percent of victims, Asia-Pacific 30 percent, Europe 14 percent, and the Middle East and Africa 10 percent.

Among the specific victims named in U.S. court filings were Instituto de Ojos in Puerto Rico, US BioTek Laboratories in Washington state (both compromised in March 2025), and Accelerated Academy in Louisiana (September 2025). The attacks caused millions of dollars in damages through ransom payments, operational disruption, and reputational harm.

AI-Assisted Cybercrime

In a detail that underscores the evolving threat landscape, Europol disclosed that KillSec leveraged artificial intelligence tools to build and maintain its ransomware infrastructure and to identify potential victims. While investigators did not publicly detail which specific AI tools or techniques the group used, the revelation adds to a growing body of evidence that threat actors — even very young ones — are using generative AI to accelerate and scale their operations. The group’s attack methods included phishing campaigns, RDP brute-force attacks, vulnerability exploitation, and targeting misconfigured cloud storage.

What Comes Next

The 110-plus terabytes of seized data are expected to yield a trove of intelligence. Investigators believe the data will help identify previously unknown victims and additional participants in the KillSec network. The investigation remains active, with authorities continuing to pursue other possible members and affiliates.

“We have undermined the group’s ability to rebuild, limited their operational reach, and reduced the likelihood of future attacks,” the FBI’s Cyber Division said in a statement. Dmitry Volkov, CEO of cybersecurity firm Group-IB — which supported the investigation with intelligence on KillSec’s operations, infrastructure, and key enablers — offered a more pointed assessment: “Servers can be replaced in weeks; the people who build the platform and approve every attack cannot.”

Takeaways

The KillSec takedown carries several lessons for the security community. First, the barrier to entry for running sophisticated cybercriminal operations continues to fall. A teenager with access to AI tooling and a RaaS model was able to orchestrate hundreds of attacks across dozens of countries. Second, international law enforcement cooperation is maturing — Operation KillSwitch’s coordination across ten countries and multiple judicial systems demonstrates that cross-border takedowns, while complex, are becoming more routine. Third, the healthcare and financial services sectors remain prime targets for ransomware operators, reinforcing the need for robust patch management, cloud security hygiene, and incident response planning in those verticals.

Organizations should treat this as a reminder to review their exposure: ensure remote desktop services are not publicly accessible, audit cloud storage permissions, maintain offline backups, and have a tested incident response plan ready. The fact that a 16-year-old could build and run a ransomware empire responsible for hundreds of breaches is not a quirky headline — it is a signal about where the threat landscape is headed.