Operation KillSwitch: Dutch citizen arrested in United Kingdom for cyber fraud from Puerto Rico
The Federal Prosecutor's Office of Puerto Rico arrested Fouad Eltibrizi in the United Kingdom for cyber fraud with the KillSec group. A 16-year-old teenager was detained in Spain as the alleged administrator of the group.
Dutch man arrested in United Kingdom for cyber attacks linked to Puerto Rico
The Federal Prosecutor's Office of Puerto Rico announced on Thursday the detention in the United Kingdom of Fouad Eltibrizi, a Dutch citizen resident in that country, accused of being part of the KillSec ransomware group, according to laprensa.hn. The international operation, named KillSwitch, concluded with three arrests and the search of eight properties in Greece, Romania, Spain and the United Kingdom.
A federal jury presented formal charges against Eltibrizi on 16 September, known by the alias "Archduke". The charges include conspiracy to access computer systems without authorisation for profit, causing damage to protected computers and transmitting threats to obtain data through extortion.
Eltibrizi was arrested on Wednesday and remains pending extradition to appear before a court in Puerto Rico. If found guilty, he faces a maximum sentence of ten years' imprisonment.
Modus operandi: data theft and extortion on the dark web
According to judicial documents, from at least March 2025 to November of that same year, Eltibrizi and his accomplices accessed the computer systems of various victims. KillSec stole confidential information—frequently data from companies or clients—and stored it on its own server.
A portion of the files was published on the dark web as a sample; the group then contacted the victims with a ransom demand. Those who did not pay saw all their data published or sold on that same platform.
In March 2025, KillSec published on its leak site that it had attacked a company in Puerto Rico, granting a period of seven days to pay the ransom. In the absence of a response, the group released approximately 180 gigabytes of stolen data on the dark web. The indictment describes similar attacks in other locations in the United States.
16-year-old teenager detained in Spain as alleged administrator
The Spanish Guardia Civil reported in a statement that the investigation began in 2025 following collaboration with the San Juan FBI, with the aim of identifying members of KillSec residing in Spain. The result was the arrest of a 16-year-old teenager who was suspected of being the group's main administrator.
The group is credited with approximately 1,000 possible attacks worldwide. Of these, approximately 500 would have been successful, with more than 280 victims, some of whom would have paid ransoms totalling close to €500,000 in cryptocurrency.
Operation KillSwitch was coordinated by law enforcement forces from ten countries and resulted in three arrests in total, in addition to the search of the eight properties mentioned.
Source: Google News PR — Crime