Dutch 'Archduke' indicted over KillSec ransomware attacks faces US extradition after international takedown

A Dutch national accused of acting as a member of the KillSec ransomware group has been indicted in the United States and is awaiting extradition from Britain, the US Department of Justice said, days after an international operation dismantled the group’s infrastructure and arrested three suspects.

A federal grand jury in the District of Puerto Rico returned the indictment on 16 September, charging Fouad Eltibrizi, known online as “Archduke”, with conspiracy to access computers without authorisation for financial gain, intentionally damaging protected computers, and transmitting threats to extort. Eltibrizi, a Dutch national resident in the United Kingdom, was arrested there on 30 September and is pending extradition to the US. If convicted, he faces a maximum of 10 years in prison.

According to court documents cited by the department, from at least March 2025 to November 2025 Eltibrizi and co-conspirators operating as the “Kill Security Ransomware Group” gained access to victims’ computers by exploiting vulnerabilities, stole sensitive business and client data, and stored it on an exfiltration server abroad. A portion of the data was published on KillSec’s dark-web leak site before victims were contacted with ransom demands.

In March 2025, the group posted on its leak site that it had breached a company in Puerto Rico, gave the firm a seven-day countdown to pay, and published samples of stolen patient data. When the victim did not respond, KillSec released about 180 gigabytes of stolen data on the dark web, the department said. The indictment also describes similar breaches in California, Washington state and Louisiana.

The arrest coincided with Operation KillSwitch, a coordinated strike on 30 September in which authorities in the US and Europe carried out eight residential searches in Spain, Greece, Britain and Romania, made three provisional arrests, and seized digital infrastructure, evidence and criminal assets. Agencies involved included Europol, Eurojust, Germany’s LKA541, Spain’s Guardia Civil and Mossos d’Esquadra, Britain’s Eastern Region Special Operations Unit, Romania’s Central Cybercrime Unit, the Hellenic Police, Belgium’s Federal Police and Switzerland’s Federal Office of Police, with assistance from the Netherlands.

Law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access. Investigators have linked the group to around 1,000 suspected attacks worldwide, of which about 500 have so far been identified as successful; that figure may change as seized evidence is examined.

Spanish authorities separately detained a 16-year-old Romanian national in Alicante who investigators suspect was the group’s main operator and administrator, according to Europol, which has not named the teenager.

“The defendant and his co-conspirators carried out targeted intrusions against multiple companies and organizations, stealing highly sensitive information and attempting to extort their victims for substantial sums of money,” said Héctor Ramírez-Carbó, acting US attorney for the District of Puerto Rico. “Ransomware remains a serious and evolving threat to all sectors of our economy.”

FBI San Juan special agent in charge Carlos R. Goris said the arrests showed the bureau’s commitment to bring cyber criminals to justice “no matter where they operate”. An indictment is an allegation, and Eltibrizi is presumed innocent until proven guilty.