Teenage Hacker Arrested in Spain for Massive Cyberattacks on Strategic Organisations

In a significant crackdown on cybercrime, Spanish authorities have arrested an 18-year-old hacker, known by the alias 'Natohub,' who has been identified as one of the most active and dangerous hackers in recent years. The arrest took place on Tuesday in the town of Calpe, Alicante, as part of Operation ‘Abbadon-Theatre.’

The Hacker's Exploits

'Natohub,' a young man studying computer science, had been evading cybercrime specialists for months. His most notable exploit was the breach of the Ministry of Defence's systems, specifically the 'virtual campus' where civil servants enter their data for academic training. This breach resulted in the theft of personal data, including emails, of approximately 180,000 members of the Guardia Civil, Armed Forces, and Ministry of Defence personnel. The stolen data was subsequently offered for sale on a well-known cybercriminal portal.

Extensive Cyberattack Campaign

The teenager's cyberattack campaign was far-reaching, targeting over 40 strategic public and private entities. His victims included the Guardia Civil, the Ministry of Defence, the National Mint (Fábrica Nacional de Moneda y Timbre), the Public Employment Service (Servicio Público de Empleo Estatal), several Spanish universities, the US Army, the Dirección General de Tráfico, the Generalitat Valenciana regional government, the United Nations, and the International Civil Aviation Organisation.

Advanced Techniques and Blockchain Knowledge

'Natohub' demonstrated a sophisticated understanding of blockchain technology, managing over 50 cryptocurrency accounts. He used advanced techniques such as anonymous messaging apps and encrypted browsing to cover his tracks and avoid detection. The hacker frequently changed his identities, using various pseudonyms on dark web forums to publicize his attacks and remain anonymous.

Investigation and International Collaboration

The arrest was the culmination of a joint effort between the Guardia Civil, Policía Nacional, and Spain’s National Cryptologic Centre (CCN), with support from the National Intelligence Centre (CNI). International collaboration included Europol and the US Homeland Security Investigations (HSI). The Central Operational Unit of the Guardia Civil played a crucial role in the investigations, which were intensified following the December 2024 attack on the Guardia Civil's database.

Legal Proceedings

The detained individual has been presented before the Court of Instruction in Denia and faces multiple charges related to cybersecurity breaches, including crimes of discovery and disclosure of secrets, illegal access to computer systems, computer damage, and money laundering. His mother, a high school teacher, paid bail for her son, and his passport was withdrawn as a precautionary measure.

Ongoing Analysis

During the search of his home, authorities seized a significant amount of computer material, which is currently under forensic analysis. This ongoing analysis may uncover further evidence of criminal activity.

The arrest of 'Natohub' marks a significant victory for law enforcement in the fight against cybercrime, highlighting the importance of international cooperation and advanced cybersecurity measures.