Emerging ThreatsMalware & Ransomware

Law Enforcement Disrupts KillSec Ransomware Group with Global Arrests

Analyst 207||Source: InfoSecMag
Global law enforcement officials gather around a table with a large screen displaying a world map in the background.
“KillSec's affiliates went after the organizations people depend on most: hospitals, government bodies, and financial institutions,” said Group-IB CEO, Dmitry Volkov.

That assessment frames a coordinated law-enforcement sweep that ripped into a prolific ransomware-as-a-service (RaaS) group called KillSec. Led by German police under an operation named KillSwitch and supported by Europol and private firm Group-IB, authorities say they dismantled core infrastructure, executed cross-border searches, and detained suspected operators — including a 16-year-old alleged ringleader arrested in Alicante, Spain.

Europol and Operation KillSwitch

Europol described the action as Operation KillSwitch. According to Europol, KillSec has been active since 2024 and "carried out at least 500 successful attacks in that time, although it is responsible for twice that number." Law enforcement seized the group's leak site and said the takedown prevented at least 110TB of stolen data from being exposed. Five servers used to manage KillSec’s activities and store victims’ data were claimed by police, and domains linked to the group now redirect to a police seizure notice.

Arrests, searches and evidence seized across Europe

Authorities executed eight house searches in Spain, Greece, Romania, and the UK. Police seized evidence and assets and made three provisional arrests. The detained 16-year-old is described in reports as a Romanian national arrested in the Spanish city of Alicante; other individuals identified include a suspected developer who turned 18 in August 2026, a person believed to have negotiated with victims, and another affiliate.

KillSec’s methods: vulnerabilities, cloud storage and mixed extortion

Europol and Group-IB described KillSec as a RaaS outfit that targeted organizations by exploiting software vulnerabilities and poorly secure cloud storage access points. The group used Windows and VMware ESXi virtualization lockers but did not always encrypt victim systems; in some cases it stole data and relied on extortion rather than encryption. Group-IB said KillSec depended on a small core team that developed the locker and approved each build, signaling an operational model that combined development, approval and affiliate execution.

Victim profile and public claims identified by Group-IB

Group-IB identified 274 publicly claimed victims tied to KillSec. The firm reported that most of those organizations were based in the United States (35%) and India (17%). KillSec advertised stolen data for sale on its platforms, acting both as a ransomware operator and a data broker; price tags for stolen datasets ranged from $5,000 to $500,000, according to Group-IB’s findings.

What this means for hospitals, government bodies, and financial institutions

  • Hospitals: The public attribution that KillSec “went after” hospitals underscores continued exposure for healthcare organizations where patient care and service continuity can be immediately affected by data theft or extortion.
  • Government bodies: Public-sector entities named in the takedown face the twin tasks of confirming whether data was exfiltrated and strengthening defenses where poor cloud configurations or unpatched vulnerabilities were exploited.
  • Financial institutions: For banks and related firms, the mix of locker tools and data brokerage poses both availability and confidentiality risks — and raises the cost calculus for incident response and potential regulatory scrutiny.

Indictment of Fouad Eltibrizi (aka Archduke) and U.S. charges

U.S. authorities announced the indictment of a Dutch national living in the UK, identified as Fouad Eltibrizi (aka Archduke). British police arrested Eltibrizi on September 30, and he is charged with hacking and extortion-related offenses that, if proven, carry a maximum sentence of 10 years imprisonment. The U.S. action shows prosecutors pursuing individuals connected to KillSec beyond the core seizures and provisional arrests carried out in Europe.

Operation KillSwitch dismantled parts of an active criminal platform, stopped the public release of a substantial trove of stolen files, and brought several suspects into custody. Yet the operation’s architects — those who developed and approved the locker builds, Group-IB said — remain the critical targets if law enforcement seeks to convert a pause into an enduring end to KillSec’s activities. The coming weeks will test whether evidence seized across multiple countries produces prosecutions that match the scale of the group's alleged campaign.

Original story

Emerging ThreatsEuropolFinancial InstitutionsGroup-IbHealthcareLaw EnforcementNation-StateRansomwareRansomware-As-A-ServiceRaasKillsecOperation KillswitchGlobal ArrestsGovernment Bodies
Related Intelligence

Continue Reading

Brightly-lit office workstation with laptop showing social media interface.

Microsoft X Account Hijacked in Crypto Pump-and-Dump Scam

Microsoft's official X account was hijacked by unknown attackers, who used its 13 million followers to promote a cryptocurrency token in a pump-and-dump scam, prompting the company to apologize and vow to take legal action. The account has since been secured and Microsoft is investigating the incident.

Analyst 207
A brightly-lit IT workstation area with desks, computer equipment, and networking gear.

Zero-Days Exploited in Agentic AI Attack on Dutch Vulnerability Disclosure Institute

In a shocking cyberattack, hackers exploited zero-day vulnerabilities to hijack sessions, run code remotely, and escalate privileges in mere seconds, targeting the Dutch Vulnerability Disclosure Institute, a volunteer-run nonprofit dedicated to ethical vulnerability disclosure. The Institute's own expertise and swift incident response actions ultimately thwarted the attack.

Analyst 207
Law enforcement officers monitor screens and review documents in a briefing room with a large world map display.

Authorities Disrupt KillSec Extortion Group in Global Operation

In a major breakthrough, law enforcement agencies from 10 countries joined forces to dismantle the notorious KillSec Extortion Group, seizing key infrastructure and arresting three suspects behind the gang's notorious extortion spree that compromised around 500 organizations. This global operation, dubbed "Operation KillSwitch," resulted in the confiscation of 110 terabytes of data and critical servers used by the group.

Analyst 207
Rack-mounted network device with blinking lights in a data center setting.

Fortinet FortiMail Zero-Day Flaw Exploited in Attacks

A critical Fortinet FortiMail flaw, rated CVSS 9.8, is being actively exploited by attackers, allowing them to write arbitrary files to vulnerable systems without needing authentication. This severe vulnerability combines a path traversal and a NULL-byte handling error, making it a high-risk threat.

Analyst 207