The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Investigators identified a 16-year-old as the suspected main operator and administrator of the KillSec ransomware group, according to Europol and Eurojust. On 30 September 2026, authorities disrupted the group’s leak site and took control of its infrastructure. The minor has not been publicly identified in the cited official releases, and the reported role is an allegation—not a conviction.
What happened in Operation KillSwitch?
On 30 September 2026, German-led Operation KillSwitch disrupted KillSec’s online operations. Europol says authorities took control of the group’s leak site and secured at least 110 terabytes of data against further unauthorized access. Eurojust reports that authorities also took control of KillSec domains and seized five servers used to manage activities and store victim data.
As an Amazon Associate I earn from qualifying purchases.
Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain and the United Kingdom, Eurojust says. Germany led the operation, with Europol supporting police coordination and Eurojust supporting judicial coordination. Eurojust lists Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States as participating countries; the U.S. Department of Justice says Dutch authorities also assisted.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe 110-terabyte figure describes data secured, not ransom payments or a confirmed number of victims. The agencies say investigators are examining seized devices and data, tracing proceeds, and looking for additional attacks, victims and participants, so the investigation and its reported figures may change. Europol’s newsroom and Eurojust’s news releases provide the agencies’ operation updates.
#1 Best Overall
Was the KillSec administrator really 16?
Europol and Eurojust say investigators identified a 16-year-old as KillSec’s suspected main operator and administrator. Their public releases do not name the minor. The age and alleged role should therefore be understood as investigators’ account, not as a court finding.
Authorities also describe suspected roles including a developer, negotiator and affiliate. Eurojust says one developer had recently turned 18 and was a minor during some of the alleged offenses. These descriptions concern suspects; the cited releases do not establish guilt.
Rank #2
Is the 16-year-old the same person as Fouad Eltibrizi?
No. The U.S. Department of Justice names Fouad Eltibrizi, also known as “Archduke,” as a separate adult defendant. DOJ says Eltibrizi, a Dutch national residing in the United Kingdom, was arrested there on 30 September 2026 and is pending extradition. A federal grand jury in Puerto Rico indicted him on 16 September 2026 on allegations involving conspiracy to access computers without authorization, damage protected computers and make extortion-related threats. The release does not say he is the 16-year-old.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDOJ emphasizes that an indictment is an allegation and that defendants are presumed innocent unless proven guilty beyond a reasonable doubt in court. Its account of the case alleges that operators between March and November 2025 exploited vulnerabilities, copied sensitive business or client data to a server abroad, posted samples on the dark web and demanded ransom. DOJ says about 180 gigabytes of data connected to a Puerto Rico victim were later published after the victim did not respond. Those details are allegations in the indictment, not adjudicated facts. The U.S. Attorney’s Office for the District of Puerto Rico publishes the DOJ release.
Rank #3
How many attacks and victims are linked to KillSec?
The numbers describe different things and come from different sources; they are not interchangeable.
| Figure | What it counts | Source and qualification |
|---|---|---|
| Around 1,000 | Suspected attacks worldwide linked to the investigation | Europol, 2026; investigation ongoing. |
| Around 500 | Suspected attacks identified so far as successful | Polizei Hamburg, 2026; the count may change as evidence is analyzed. DOJ also reported about 500 suspected successful attacks at the time of its release. |
| At least 70 | Suspected cases linked to Germany | Polizei Hamburg, 2026; figure may change. |
| 18 | Cases currently linked to Hamburg | Polizei Hamburg, 2026; figure may change. |
| 274 | Organizations publicly claimed as victims on KillSec’s leak site | Group-IB’s monitoring, 2026; this is the vendor’s observed public-claim count, not a government-confirmed victim total. |
In particular, around 1,000 suspected attacks does not mean 1,000 confirmed victims. Police describe the successful-attack count as provisional while evidence is reviewed. See Polizei Hamburg for the agency’s case figures and Group-IB’s threat research for its monitoring description.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How authorities say KillSec operated
Eurojust says KillSec had been active since 2024 and allegedly exploited poorly secured access points, particularly those linked to cloud storage, to enter organizations’ systems. Investigators say the group copied sensitive data to its own infrastructure, threatened to publish it unless victims paid, and in some cases made stolen files available for free download when victims did not pay.
Cybersecurity company Group-IB characterizes KillSec as a financially motivated ransomware-as-a-service group, saying affiliates used the platform and its infrastructure. Group-IB also reports that KillSec advertised stolen data for sale. These are the company’s descriptions and monitoring, not court findings.
Europol and Polizei Hamburg report that investigators uncovered the use of AI to build and maintain ransomware infrastructure and identify potential victims. The authorities have not specified which tools or models were involved or how much of the work was automated.
What organizations can take from the case
Group-IB recommends several defensive practices for organizations. They are general risk-reduction measures, not guarantees that a particular attack would be prevented.
- Reduce exposed access: keep an ongoing inventory of internet-facing assets and require multifactor authentication (MFA) for remote access.
- Reduce exploitable weaknesses: prioritize patching vulnerabilities known to be exploited in the wild.
- Support recovery: keep offline, immutable backups so that recovery copies are harder to alter or reach during an intrusion.
Group-IB says it contributed intelligence to the investigation. Its recommendations do not establish that any one control would have prevented the alleged incidents.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
