Overview
- Law enforcement carried out Operation KillSwitch on Wednesday and took control of KillSec’s leak site, seized five core servers and placed at least 110 terabytes of stolen data under police control while making three provisional arrests.
- Spanish investigators detained an unnamed 16‑year‑old in Alicante who is suspected to be KillSec’s administrator and main operator, and UK police arrested Fouad Eltibrizi, who has been indicted by U.S. authorities and faces possible extradition.
- Authorities searched eight properties across Spain, Greece, Romania and the UK and seized computers, phones and cryptocurrency wallets as an initial analysis found transactions that match ransom payments.
- Evidence collected so far shows KillSec ran a ransomware‑as‑a‑service network since about 2024 that exploited software flaws, exposed cloud storage and weak remote access, used affiliates to scale attacks and employed AI to help build infrastructure and pick targets.
- Investigators from multiple countries are now forensically analysing files and servers and tracing cryptocurrency to identify more victims and suspects, with officials warning that confirmed attack and victim counts may change as evidence is processed.