European police dismantle KillSec ransomware group led by 16-year-old in Spain

Operation KillSwitch and arrests

Law enforcement agencies across Europe dismantled the KillSec cybercrime syndicate in a coordinated action named Operation KillSwitch. Led by German authorities with assistance from Europol and Eurojust, the operation targeted a network tied to approximately 1,000 ransomware attacks over two years, about 500 of which succeeded. Officers conducted eight searches across Spain, Greece, Romania, and the United Kingdom, leading to multiple arrests. Investigators confirmed the group exploited software vulnerabilities and cloud storage flaws to steal confidential data, threatening public release on the dark web unless victims paid ransoms in cryptocurrency.

The teenage ringleader in Alicante

In Spain, the Guardia Civil and the Catalan police force (Mossos d'Esquadra) arrested a 16-year-old Romanian national in the town of La Romana, a municipality of 2,700 residents in Alicante province. Investigators identified the teenager as the primary administrator and operator of KillSec, who managed the syndicate's dark web leak site from the home he shared with his mother. The suspect did not attend school, was entirely self-taught, and began engaging in cybercrime at age 12. His mother was also indicted for alleged involvement in his illicit activities. During searches at his home and a local hotel office, police confiscated computers, mobile phones, cryptocurrency wallets, and encryption tools.

“He was the main administrator of the website, which they had on the dark web. A developer who controlled the IT infrastructure. In addition to their own attacks, they also rented the platform to third parties.”

Investigation leads and technical infrastructure

The investigation gained traction following an attack on the Catalan public infrastructure agency, Infraestructuras de la Generalitat, where KillSec demanded a ransom of 15 million dollars (13.3 million euros) in cryptocurrency. A technical error during that breach exposed an IP address linking directly to the teenager's residence in Alicante. Parallel to the IP trace, the Central Operative Unit of the Guardia Civil matched the suspect to an image of a brightly colored motorcycle on WhatsApp associated with a Spanish telephone number. That photographic evidence was supplied by the Federal Bureau of Investigation, which had tracked the network following attacks in Puerto Rico. Investigators also determined KillSec utilized artificial intelligence to build and maintain ransomware infrastructure and select victim targets.

International suspects and data seizure

Beyond the Spanish arrests, international authorities seized KillSec's leak portal and secured at least 110 terabytes of stolen data. In the United Kingdom, police arrested Dutch national Fouad E., known online as Archduke, who was indicted by a federal grand jury in Puerto Rico over a March 2025 breach involving 180 gigabytes of leaked corporate files. United States authorities are currently seeking his extradition. The cross-border sweep also identified an 18-year-old developer who turned 18 in August 2026, alongside two suspects in their twenties detained in the United Kingdom and Romania. Police continue to analyze seized devices to trace financial flows and identify further victim organizations.

Investigated attacks1,000

Successful attacks500

Property searches8

Investigated attacks

1000 count

Successful attacks

500 count

Property searches

8 count

Data from the article text