Authorities Arrest Three Suspects and Seize KillSec Ransomware Infrastructure
Summary
An international operation led by German authorities arrested three suspects, including a 16-year-old alleged KillSec administrator, and seized servers, domains, and the group’s leak site. Investigators linked KillSec to about 500 confirmed attacks.
Key points
- Authorities arrested three suspects and searched eight properties across Spain, Greece, Romania, and the UK.
- A 16-year-old Romanian national was identified as the alleged administrator of the KillSec operation and arrested in Spain.
- Investigators seized five servers, took control of domains and the leak website, and secured at least 110TB of data.
- Authorities investigated roughly 1,000 suspected KillSec attacks worldwide and have confirmed about 500 as successful; at least 70 involved government organizations.
- UK police arrested Dutch national Fouad Eltibrizi, also known as “Archduke”; he is expected to be extradited to the US to face charges related to unauthorized computer access conspiracy.
- KillSec reportedly exploited known vulnerabilities and poorly secured access points to enter systems and steal data for extortion.
Article Details
- Event Type
- International law enforcement takedown of the KillSec ransomware operation, involving arrests, property searches, and the seizure of infrastructure.
- Impact
- Authorities said they investigated roughly 1,000 suspected attacks worldwide, at least 70 involving government organizations, and confirmed about 500 as successful. They arrested three suspects, searched eight properties, took control of five servers and KillSec-operated domains, seized at least 110TB of data, and took down the group's leak website. Bitdefender reported nearly 300 victims appearing on the leak site since it began tracking KillSec, while cautioning that leak-site counts may not reflect the actual number of victims.
People
Threat Actors
ArchdukeAlias the source gives for Fouad Eltibrizi, who was arrested in the UK and is accused of a role related to KillSec.Fouad EltibriziAlleged participant in the KillSec operation; the source says he is also known as Archduke.KillSecRansomware group whose operation was targeted in the takedown; authorities allege it was responsible for cyberattacks and used a leak site to threaten publication of stolen data.
Vendors
Countries
GermanyAuthorities from multiple countries, including Germany, the United States, the United Kingdom, Spain, Romania, and Greece, took part in the investigation.Greeceoperation that resulted in the arrests of three suspects and searches of eight properties in Spain, Greece, Romania, and the UK.Romaniathat resulted in the arrests of three suspects and searches of eight properties in Spain, Greece, Romania, and the UK.Spainenforcement operation that resulted in the arrests of three suspects and searches of eight properties in Spain, Greece, Romania, and the UK.United KingdomAuthorities from multiple countries, including Germany, the United States, the United Kingdom, Spain, Romania, and Greece, took part in the investigation.United StatesAuthorities from multiple countries, including Germany, the United States, the United Kingdom, Spain, Romania, and Greece, took part in the investigation.