--- title: Alleged KillSec Ransomware Mastermind a 16-Year-Old description: German authorities identified a 16-year-old Romanian national as the alleged administrator of the KillSec ransomware operation, following an international law... canonical: https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Alleged KillSec Ransomware Mastermind a 16-Year-Old | daily.dev og:description: German authorities identified a 16-year-old Romanian national as the alleged administrator of the KillSec ransomware operation, following an international law... og:url: https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm og:image: https://api.daily.dev/og/posts/aYzmrwGwm.png og:image:alt: Alleged KillSec Ransomware Mastermind a 16-Year-Old og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Alleged KillSec Ransomware Mastermind a 16-Year-Old **[Dark Reading](https://daily.dev/sources/dr)** · 3 min read · 0 upvotes · 0 comments ## Summary German authorities identified a 16-year-old Romanian national as the alleged administrator of the KillSec ransomware operation, following an international law enforcement effort dubbed Operation KillSwitch. The operation led to three provisional arrests, searches of eight properties across Spain, Greece, Romania and the UK, seizure of five servers, and control of over 110TB of data. KillSec, active since 2024, exploited known vulnerabilities and misconfigured cloud access points, claiming roughly 500 confirmed victims out of 1,000 suspected attacks, including 70 government targets. Bitdefender and Group-IB provided technical support, and investigators found evidence the group used AI to build infrastructure and identify victims. A Dutch national, Fouad Eltibrizi, was separately indicted by the US DOJ and arrested in the UK pending extradition. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Who was arrested in connection with the KillSec ransomware group takedown? A 16-year-old Romanian national, described by Europol as the administrator of the KillSec operation, was provisionally arrested in Alicante, Spain. Two other individuals were also provisionally arrested, and Dutch national Fouad Eltibrizi, known as 'Archduke', was separately indicted by the US Justice Department and arrested in the UK pending extradition on unauthorized computer access conspiracy charges carrying up to 10 years in prison. _Security teams tracking ransomware actor disruptions follow cases like KillSec's takedown on daily.dev._ ### How many victims did the KillSec ransomware group claim and how did it operate? KillSec, active since 2024, claimed close to 300 victims on its leak site, with investigators confirming about 500 successful attacks out of roughly 1,000 suspected incidents, at least 70 against government organizations. The group exploited known vulnerabilities and poorly secured cloud access points to exfiltrate data, then threatened to publish it unless victims paid ransom, and reportedly used AI to build infrastructure and identify targets. _Anyone assessing ransomware exposure can track threat actor tactics like KillSec's on daily.dev._ ## Similar posts on daily.dev - [Polish cops arrest 47-year-old man in Phobos ransomware raid](https://daily.dev/posts/polish-cops-arrest-47-year-old-man-in-phobos-ransomware-raid-slb53v95j) · The Register · 1 upvotes · 0 comments - [Who Runs the Ransomware Group ‘The Gentlemen?’ – Krebs on Security](https://daily.dev/posts/who-runs-the-ransomware-group-the-gentlemen-krebs-on-security-nte3fcfvr) · Krebs on Security · 0 upvotes · 0 comments - [DOJ says ransomware gang tapped into Russian government databases](https://daily.dev/posts/doj-says-ransomware-gang-tapped-into-russian-government-databases-hmfbviv8l) · TechCrunch · 0 upvotes · 0 comments - [Sicarii Ransomware: Truth vs Myth](https://daily.dev/posts/sicarii-ransomware-truth-vs-myth-epkoofcfp) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Alleged KillSec Ransomware Mastermind a 16-Year-Old","url":"https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm"},"datePublished":"2026-10-01T21:42:55.382Z","dateModified":"2026-10-01T21:43:16.304Z","description":"German authorities identified a 16-year-old Romanian national as the alleged administrator of the KillSec ransomware operation, following an international law...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0730a64eb1ff42237b4bc252d0a837af?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0730a64eb1ff42237b4bc252d0a837af?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Alleged KillSec Ransomware Mastermind a 16-Year-Old"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/alleged-killsec-ransomware-mastermind-a-16-year-old-ayzmrwgwm#faq","mainEntity":[{"@type":"Question","name":"Who was arrested in connection with the KillSec ransomware group takedown?","acceptedAnswer":{"@type":"Answer","text":"A 16-year-old Romanian national, described by Europol as the administrator of the KillSec operation, was provisionally arrested in Alicante, Spain. Two other individuals were also provisionally arrested, and Dutch national Fouad Eltibrizi, known as 'Archduke', was separately indicted by the US Justice Department and arrested in the UK pending extradition on unauthorized computer access conspiracy charges carrying up to 10 years in prison. Security teams tracking ransomware actor disruptions follow cases like KillSec's takedown on daily.dev."}},{"@type":"Question","name":"How many victims did the KillSec ransomware group claim and how did it operate?","acceptedAnswer":{"@type":"Answer","text":"KillSec, active since 2024, claimed close to 300 victims on its leak site, with investigators confirming about 500 successful attacks out of roughly 1,000 suspected incidents, at least 70 against government organizations. The group exploited known vulnerabilities and poorly secured cloud access points to exfiltrate data, then threatened to publish it unless victims paid ransom, and reportedly used AI to build infrastructure and identify targets. Anyone assessing ransomware exposure can track threat actor tactics like KillSec's on daily.dev."}}]} ```