Spain Arrests Romanian Teen, 16, as Alleged KillSec Boss

Spanish police arrested the 16-year-old Romanian suspected of running KillSec in Alicante, as authorities named the crew's distinct member roles.

Spanish police said Thursday they arrested the 16-year-old suspected main operator of the KillSec ransomware group in the city of Alicante, identifying him as a Romanian national, according to Reuters via TechNadu. Europol also disclosed that investigators have mapped distinct roles inside the crew — an administrator, a developer, a negotiator and an affiliate — the kind of organizational chart typically built for adult syndicates.

According to a Europol spokesperson cited by TechNadu, two other suspects in their twenties were arrested — one in Britain and one in Romania — and Puerto Rico has filed an extradition request for the man arrested in the U.K. Authorities searched eight properties across Greece, Romania, Spain and the United Kingdom as part of the coordinated action. TechNadu also reports that a suspected developer was identified but not arrested; he turned 18 in August 2026, meaning he was a minor when some of the alleged offenses were committed. Inquiries into other possible members continue, and investigators are tracing criminal proceeds including cryptocurrency.

TechNadu reports that KillSec began in 2021 with hacktivist origins, conducting DDoS attacks and website defacements aligned with Anonymous and carrying pro-Russian, anti-Western messaging. Around 2024 the group pivoted to a ransomware-as-a-service model, exploiting cloud misconfigurations rather than zero-days and using double extortion. Of roughly 1,000 suspected attacks worldwide, about 500 have been identified as successful so far, a figure that may change as seized evidence is examined.

Operation KillSwitch was led by Hamburg's State Criminal Police Office and Public Prosecutor's Office, with ten countries taking part and coordination support from Eurojust's coordination center and the Joint Cybercrime Action Taskforce, TechNadu reports. Cybersecurity firms Bitdefender and Group-IB supported the investigation. Law enforcement took control of five central servers and the group's leak site on September 30, securing at least 110 terabytes of data against further unauthorized access; shattered.io reports roughly 1,000 attacks are attributed to the group. Authorities say the seized evidence may help identify further victims, attacks and people involved, and prior takedowns suggest stolen data can resurface even after a leak site goes dark, so victims should treat the takedown as containment rather than erasure of exposure.