Teenagers suspected of leading ransomware group arrested
Assessment
Eurojust's headline uses the plural, but its own text and every other primary source name one suspected leader: a 16-year-old described as the administrator and main operator, arrested in Alicante province by the Mossos d'Esquadra and Guardia Civil. The second teenager in the releases, a suspected developer who turned 18 in August 2026, is described as identified, not as a leader, and Risky Business reports he was not arrested. The other two arrests were a 24-year-old detained by DIICOT in Romania and a UK arrest that Computer Weekly and Risky Business report was Fouad Eltibrizi, whose age DOJ does not give (Brit Brief, citing ERSOU, reports the UK arrestee was 25). Only one arrestee is described as a minor in any primary source.
Where this claim appeared
Eurojust · 2026-10-01
https://www.eurojust.europa.eu/news/teenagers-suspected-leading-ransomware-group-arrested-during-international-operationWhat “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
Operation KillSwitch: KillSec ransomware takedown, a 16-year-old suspect and a US indictmentThink this assessment is wrong? Report an error.