Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictment

Executive Summary

On 30 September 2026, law enforcement in a German-led investigation called Operation KillSwitch took control of the dark web leak site of KillSec (also tracked as Kill Security and k1llsec), secured at least 110 terabytes of stolen data, brought five central servers under police control, carried out eight searches in Greece, Romania, Spain and the United Kingdom, and made three provisional arrests¹. The operation was led by the Hamburg State Criminal Police Office (Landeskriminalamt Hamburg) and the Hamburg Public Prosecutor's Office, with Europol and Eurojust coordinating, and was announced on 1 October 2026¹²³. Investigators identified a 16-year-old as the group's suspected administrator and main operator; that suspect was arrested in Alicante province, Spain, by the Mossos d'Esquadra and the Guardia Civil¹⁴. ThreatPaper does not name the minor.

The same day, the US Attorney's Office for the District of Puerto Rico announced that a grand jury had indicted Fouad Eltibrizi (a/k/a "Archduke"), a Dutch national living in the United Kingdom, on 16 September 2026, and that he was arrested in the UK on 30 September and is pending extradition³. The indictment alleges that from at least March 2025 to November 2025 Eltibrizi and co-conspirators "forming what is known as the Kill Security Ransomware Group" broke into victims' systems through vulnerabilities, stole data to an exfiltration server abroad, published samples on a leak site and demanded ransom, including from a Puerto Rico company whose roughly 180 gigabytes of data, including patient data, were released after it ignored a seven-day countdown³. He is charged, not convicted, and is presumed innocent³.

Investigators describe the group's mechanism as data theft followed by extortion: exploiting software vulnerabilities and poorly secured access points, "particularly to cloud storage", copying data to infrastructure they controlled, naming victims on the leak site, and making files available for free download when a victim did not pay¹⁵. Romanian prosecutors add that members also bought access credentials sold on darknet markets and ran command-and-control servers hosted by a global cloud provider⁶. Vendor tracking before the takedown shows KillSec began as an Anonymous-aligned hacktivist outfit, turned to ransomware in October 2023, and launched a ransomware-as-a-service (RaaS) platform with a Windows locker in June 2024 and an ESXi locker in November 2024⁷⁸⁹.

The numbers in circulation do not measure the same thing. "Around 1,000" is the count of suspected attacks under investigation; around 500 have so far been identified as successful; the Catalan police put the victims at "more than 280"; the leak site itself carried between roughly 274 and 300 postings depending on who counted¹⁴⁸¹⁰. The headline framings stretch further: Eurojust's release says KillSec was "responsible for almost 1 000 attacks" under a headline about "Teenagers" arrested, when only one arrestee is described in any primary source as a teenager². The claim that the group "used AI to build and maintain its ransomware infrastructure" originates in the joint Hamburg police and Europol text and is not explained in any published source¹⁵. This paper sets out what each primary source actually says and where they disagree.

Verification of Claims

1. Claim: A 16-year-old is the suspected administrator and main operator of KillSec. → Verified (as the investigators' allegation) → Europol and the Hamburg police state that "the alleged administrator and main operator is 16 years old"¹⁵. The Catalan police note says the joint Mossos d'Esquadra and Guardia Civil investigation determined the Alicante suspect's "presumed role as principal administrator" of the group and arrested a 16-year-old there on 30 September⁴. This is an allegation against a minor, not a finding.

2. Claim: Fouad Eltibrizi led KillSec. → Unverified → No primary source says this. The DOJ release describes Eltibrizi and "co-conspirators" forming KillSec but assigns him no role³. Europol and Hamburg assign leadership to the 16-year-old¹⁵. Computer Weekly and Risky Business report that the UK arrest in the operation was Eltibrizi¹¹¹²; Brit Brief reports, citing the Eastern Region Special Operations Unit (ERSOU), that the person arrested in Levenshulme, Manchester was a 25-year-old suspected of acting as a negotiator¹³. ERSOU's own statement could not be retrieved, and no primary source states that Eltibrizi is the alleged negotiator.

3. Claim: The operation involved nine countries. → Partially verified → Eurojust says "authorities from nine countries" and lists Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the UK and the US². Europol and the Hamburg police list ten, adding the Netherlands' Centre for International Legal Assistance in Criminal Matters in Amsterdam¹⁵. The DOJ release says the Netherlands "provided valuable assistance leading up to the takedown" and does not list Finland³. Nine is the count of judicial authorities Eurojust coordinated; ten is the count of countries that took part in the investigation.

4. Claim: KillSec carried out about 1,000 attacks, about 500 of them successful. → Partially verified → Europol, the Hamburg police and DOJ all frame 1,000 as "around 1 000 suspected attacks" under investigation, and say around 500 "have so far been identified as successful", a figure that "may change"¹³⁵. Eurojust drops the qualifier and calls the group "responsible for almost 1 000 attacks"²; the Catalan police and DIICOT say "more than 1,000" and "approximately 1,000"⁴⁶. Bitdefender notes that the leak-site posting count is a different measure from attacks¹⁰.

5. Claim: The group used AI to build and maintain its infrastructure and identify victims. → Unverified (as to how) → The sentence appears in the Hamburg police release ("wie die Gruppe KI nutzte, um ihre Ransomware-Infrastruktur aufzubauen und zu betreiben sowie potenzielle Opfer zu identifizieren") and in Europol's English text¹⁵. Neither gives a tool, model, example or method. Eurojust, DOJ, DIICOT and the Catalan police do not mention AI at all²⁴³⁶. Group-IB and Bitdefender repeat it with attribution to Europol rather than from their own research⁸¹⁰.

6. Claim: KillSec encrypted victims' systems. → Partially verified → The group advertised file-encrypting lockers: a C++ Windows locker at the June 2024 RaaS launch and an ESXi locker in November 2024, both documented by Rapid7, CYFIRMA and Group-IB from the group's own advertisements and panel⁷⁸⁹. None of the six law-enforcement releases describes encryption of any victim's systems; all describe data theft and leak-site extortion¹²³⁴⁵⁶. Group-IB says "Encryption was not a precondition for a KillSec listing" and that a substantial share of claimed victims "involved no network intrusion at all"⁸.

7. Claim: KillSec has been active since around 2024. → Partially verified → Europol, Hamburg and Group-IB say "since around 2024"¹⁵⁸. DIICOT's charging description says the Romanian suspect acted within KillSec from October 2023⁶, matching Rapid7's date for the group's turn from hacktivism to ransomware⁷. Rapid7 traces the hacktivist persona to at least 2021⁷.

8. Claim: Eltibrizi faces a maximum of 10 years in prison. → Partially verified → The DOJ release states a 10-year maximum³. The court docket shows a single-count indictment, with the pending count recorded as "18:371 CONSPIRACY"¹⁴¹⁵. The general conspiracy statute, 18 U.S.C. § 371, carries a five-year maximum; a 10-year exposure would be consistent with a conspiracy charged under the Computer Fraud and Abuse Act's own conspiracy provision instead. The indictment text is not publicly available on RECAP, so the discrepancy cannot be resolved from the public record as of 2 October 2026.

9. Claim: The leak site's last victim was posted on 18 September 2026. → Partially verified → Bitdefender Labs and ransomware.live both record 18 September as the last posting¹⁰¹⁶. Risky Business reported listings "as recently as September 27"¹². The difference is unresolved.

Timeline

Operation Anatomy

How KillSec got in

The investigating authorities describe two routes: exploiting software vulnerabilities, and abusing "poorly secured access points to organisations' systems", "particularly to cloud storage" (T1190, T1530)¹⁵. DIICOT adds that members bought access credentials offered for sale on the darknet and used them to log in (T1650, T1078)⁶. Group-IB's monitoring of affiliate activity lists phishing, brute force against exposed Remote Desktop Protocol services and known vulnerabilities in internet-facing applications, and says a substantial share of claimed victims involved data "taken from cloud storage left publicly accessible through misconfiguration" with no network intrusion at all (T1566, T1110, T1133)⁸. Halcyon, a vendor, attributes exploitation of the CrushFTP authentication bypass CVE-2025-31161 to the group¹⁷; no law-enforcement source names a specific CVE.

Exfiltration and infrastructure

Once inside, members copied sensitive internal data "to infrastructure under their control"¹. DOJ says the data went to "an exfiltration server abroad"³. DIICOT says the group built a technical infrastructure for unauthorised access and data transfer and successively configured command-and-control servers "hosted by a global cloud computing provider" (T1583.003)⁶. The Hamburg police say five relevant servers, "including the main server and several exfiltration servers", were identified and shut down⁵. The leak site's seized onion address was observed with a seizure banner by BleepingComputer and ransomware.live¹⁶¹⁸.

Extortion

Victims were named on the leak site with samples of their data and a deadline; DIICOT says victims were also sent samples or links to them as proof (T1657)³⁶. If a victim did not pay, files "could be made available for free download"¹. DOJ says non-payment would result in "the full publication or sale of the data"³, and Group-IB and Rapid7 both document a for-sale section with asking prices from USD 5,000 up to USD 350,000 (Rapid7) or USD 500,000 (Group-IB)⁷⁸. The Catalan police say initial analysis of seized material shows ransom payments, some of around EUR 500,000 in cryptocurrency⁴.

The RaaS layer

From June 2024 KillSec sold affiliate access to a Tor-based panel with chat, statistics and a builder, initially for USD 250 and 12% of each ransom⁸⁹. Group-IB says builds required administrator approval, which "pointed to a small core team guarding its payload"⁸. The advertised lockers encrypted Windows files and, from November 2024, ESXi hosts, with snapshot deletion (T1486, T1490)⁷⁸. Whether those lockers were deployed against the victims in this case is not established by any primary source (see Verification item 6).

Action day

On 30 September 2026 authorities took over the leak site and five domains, redirected them to a seizure notice, and launched an operation website; the five central servers had been brought under police control over the course of the investigation¹⁵. Eurojust ran a coordination centre so measures executed simultaneously; Europol's European Cybercrime Centre traced cryptocurrency and examined digital evidence, and the Joint Cybercrime Action Taskforce handled deconfliction¹². Bitdefender and Group-IB supported the investigation¹⁸¹⁰.

Accused

Fouad Eltibrizi (a/k/a "Archduke"), Dutch national residing in the United Kingdom.

• Case: United States v. Eltibrizi, 3:26-cr-00383, US District Court for the District of Puerto Rico, assigned to Judge Gina R. Mendez-Miro; prosecuted by Assistant US Attorney Julian N. Radzinschi³¹⁴¹⁵.
• Charge: A single-count indictment returned 16 September 2026; the docket records the count as "18:371 CONSPIRACY"¹⁴¹⁵. DOJ describes it as "conspiracy to intentionally access a computer without authorization for financial gain, intentionally causing damage without authorization to a protected computer, and intentionally transmitting a threat to obtain information from a protected computer without authorization with the intent to extort", and states a maximum penalty of 10 years³. On the five-year maximum for § 371, see Verification item 8.
• Procedural status: Arrested in the UK on 30 September 2026; pending extradition; initial appearance before a magistrate judge in Puerto Rico to follow extradition³.
• Presumption of innocence: In DOJ's words, "An indictment is merely an allegation and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law."³
• Attribution and naming basis: Named because charged by indictment and named by DOJ. DOJ does not describe his role within the group³.

Other suspects (not named). The 16-year-old arrested in Alicante province is the alleged administrator and main operator; a woman there is under investigation in connection with the facts⁴. A suspected developer turned 18 in August 2026 and was a minor during some of the alleged offences; Risky Business reports he was identified in Spain but not arrested¹¹². DIICOT detained a 24-year-old on suspicion of forming an organised criminal group, illegal access to a computer system, unauthorised data transfer, illegal operations with devices or programs, and blackmail, and sought 30 days' pre-trial arrest⁶; The Register reports he is suspected of acting as an affiliate¹⁹. DIICOT states that those investigated benefit from the presumption of innocence⁶. ThreatPaper does not name any of them.

Group name: KillSec, also Kill Security, KillSecurity and k1llsec³⁸. "KillSec" is the investigators' and the group's own name, used in every primary source. Motivation: Financial; earlier hacktivist persona⁷. Sophistication: Risky Business calls KillSec "a low-to-mid tier threat actor"¹². Group-IB ranked KillSec among the ten most active ransomware groups of 2025 in Asia-Pacific, Latin America and the Middle East⁸; its RaaS entry fee was USD 250⁹. Victimology: Group-IB counted 274 organisations claimed on the leak site: about 35% United States and 17% India, with financial services and healthcare most affected⁸. The Hamburg police say at least 70 of the suspected attacks relate to Germany, 18 of them to Hamburg⁵.

MITRE ATT&CK techniques (IDs verified live on attack.mitre.org, 2 October 2026):

OPSEC: Aliases to conceal identities and encrypted messaging channels for communication²⁶. The Guardia Civil identified the Alicante suspect "starting from an image of a profile", per the Catalan police note⁴.

Technical Indicators

leak_site_onion_seized:
  - ks5424y3wpr5zlug5c7i6svvxweinhbdcqcfnptkfcutrncfazzgz5id[.]onion
leak_site_onion_earlier:
  - kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd[.]onion
law_enforcement_operation_site:
  - hxxps://www[.]operation-killswitch[.]com
vendor_listed_c2_ips_unconfirmed:
  - 82.147.84[.]98
  - 77.91.77[.]187
  - 93.123.39[.]65
vulnerability_attributed_by_vendor: CVE-2025-31161 (CrushFTP authentication bypass)
file_hashes: none disclosed
note: >
  The seized onion address was observed carrying the seizure banner by
  BleepingComputer and ransomware.live; the earlier "Kill Security 2.0" onion is
  listed by ransomware.live and Halcyon. The three IP addresses and the CVE are
  from Halcyon's threat-group profile (updated 13 November 2025), which does not
  say which incident each came from; no law-enforcement source has published
  network indicators or hashes. Halcyon itself states no locker hashes are
  publicly available. Treat the IPs as historical and unconfirmed.

Legal and Regulatory Response

Germany. The Hamburg State Criminal Police Office and the Hamburg Public Prosecutor's Office led the investigation and were responsible for the server investigation; they took over five domains and published the operation website⁵. Hamburg's interior senator called it the second international operation in a few months in which the Hamburg LKA played a key role⁵.

United States. United States v. Eltibrizi, 3:26-cr-00383 (D.P.R.): indictment 16 September 2026, sealed the same day, unsealed by order of 30 September 2026¹⁴. The FBI San Juan Field Office investigated; DOJ's Office of International Affairs and the International Computer Hacking and Intellectual Property prosecutor in The Hague supported³. Extradition from the UK is pending³.

Spain. Investigative Court No. 20 of Barcelona and the Barcelona prosecutor's office direct the Spanish case; the Mossos d'Esquadra and the Guardia Civil's Central Operational Unit ran a joint investigation team that began from the Catalan attack and from an FBI San Juan request for help identifying KillSec members in Spain¹⁴.

Romania. DIICOT's central structure detained a 24-year-old on 30 September and asked the Bucharest Tribunal for 30 days' pre-trial arrest on 1 October; a Romania–Belgium joint investigation team was agreed under Eurojust in December 2025, later joined by Greece and Germany⁶.

United Kingdom. ERSOU took part¹. Its own statement could not be retrieved as of 2 October 2026; Brit Brief reports a 25-year-old was due at Westminster Magistrates' Court for an extradition hearing on 1 October¹³.

Other. Belgium, Finland, Greece, the Netherlands and Switzerland participated; Eurojust hosted the action-day coordination centre and Europol's EC3 and J-CAT coordinated police work¹². No regulator has published a notice tied to this operation as of 2 October 2026 that this research located.

Impact Assessment

• Confirmed: At least 110 TB of data secured on the leak site; five central servers under police control; leak site and domains seized; eight searches and three provisional arrests¹²³⁵. The Catalan police note gives "1.100 terabytes", which every other primary source contradicts⁴.
• Confirmed (as investigators' count): Around 1,000 suspected attacks under investigation; around 500 identified as successful so far; both may change¹³⁵.
• Confirmed (as alleged in the indictment): A Puerto Rico company had about 180 GB of data, including patient data, released after a seven-day countdown in March 2025; the indictment also describes breaches in California, Washington State and Louisiana³.
• Reported: More than 280 victims, some of whom paid ransoms of around EUR 500,000 in cryptocurrency (Catalan police)⁴. At least 70 suspected attacks in Germany, 18 linked to Hamburg (Hamburg police)⁵. A Catalan organisation suffered close to EUR 1 million in damage⁴.
• Reported: Leak-site postings counted at 274 (Group-IB), close to 300 with 126 in 2025 and 25 in 2026 (Bitdefender), and 286 (ransomware.live)⁸¹⁰¹⁶.
• Estimated: Group-IB describes KillSec as "as much a data broker as a ransomware operator", with data asking prices from USD 5,000 to USD 500,000⁸.
• Unknown: Total ransom revenue; how many victims paid; the AI tooling the investigators refer to; whether any victim in the charged conduct was hit with encryption; Eltibrizi's alleged role; the identity of the 25-year-old reported arrested in Manchester relative to Eltibrizi.

Lessons and Defensive Recommendations

For SOC and cloud teams:

• The dominant way in was not novel: exposed cloud storage, unpatched internet-facing software, and bought credentials¹⁶⁸. Inventory every storage bucket and share that is reachable from the internet, including those left from finished projects, acquisitions and tests, which Bitdefender singles out¹⁰.
• Treat credential exposure on darknet markets as an intrusion precursor. DIICOT's account of KillSec buying access means a leaked VPN or RDP credential is a live risk until it is rotated⁶.
• Watch for bulk reads and egress from storage to unfamiliar hosts; KillSec's model needed only copying, not encryption, so ransomware detections tuned to file-encryption behaviour would not fire⁸.

For platform and virtualisation owners:

• The advertised ESXi locker shut down VMs and deleted snapshots⁸. Keep offline, immutable backups outside the hypervisor's own snapshot chain.

For healthcare and software providers:

• Group-IB says KillSec shifted in late 2025 to healthcare software and IT service providers, where one compromise exposes many clinics' patient records⁸. Providers holding data for others should assume they are the target and tell their customers how storage is exposed.

For leadership:

• A takedown does not close the gap that was exploited. Leak-site postings slowed sharply before action day, but the technique is common to many groups¹⁰.
• If you were a KillSec victim, contact the national authority listed in the Europol release: investigators are examining the 110 TB and say the evidence may identify further victims¹.

For journalists and researchers:

• Distinguish suspected attacks, successful attacks, victims, and leak-site postings. They are four different numbers here: about 1,000, about 500, more than 280, and 274 to 300¹⁴⁸¹⁰.
• Do not report the leader as the US defendant, or describe the arrestees as "teenagers": only one arrestee is described in a primary source as a minor.

Sources