Authorities dismantle KillSec group, arrest members across Europe

A multi-country police operation has taken down the KillSec ransomware gang, seizing its infrastructure and detaining three suspects across Spain, Romania, and the UK, with a fourth identified but not arrested in Spain. The alleged lead administrator turned out to be a 16-year-old Romanian national based in Alicante, while a second suspect, Dutch national Fouad Eltibrizi, was arrested in the UK and now faces a US extradition request over a March 2025 attack on a company in Puerto Rico. Since launching as a cheap ransomware-for-rent service in June 2024, KillSec reportedly powered over 1,000 intrusions worldwide, about 500 of them successful, mainly by exploiting unpatched server flaws and running double-extortion schemes; the gang has also been connected to the CrushFTP zero-day tracked as CVE-2025-31161. Despite staying relatively low-profile compared to larger crews like Qilin, DragonForce, or Akira, KillSec was still posting fresh victims on its leak site just days before the takedown.