Germany arrests alleged core member of Qilin ransomware group

Germany has arrested a Russian national suspected of being one of the leading members of the Qilin ransomware group. The arrest follows an extradition from Japan carried out earlier in October.

Japan's National Police Agency confirmed the handover, saying the suspect was detained after arriving in the country as a tourist. According to a joint statement from Japan's Ministry of Justice and the Tokyo High Public Prosecutors Office, the man was named in an arrest warrant that Germany had obtained in connection with a ransomware incident there. The Japanese authorities worked with Germany to secure a provisional detention warrant under the country's extradition law for fugitives, and then arranged the transfer.

Earlier this week Japanese media reported the arrest citing internal sources; officials have now confirmed it formally.

About Qilin

Qilin is a well-known ransomware-as-a-service operation that surfaced in August 2022 under the name Agenda. The group relied on the familiar double-extortion model, stealing data before encrypting it. Over time it grew into one of the most active threats of its kind worldwide. By recent counts it hit more than 2,350 organizations across 62 countries.

Victims include Japanese carmaker Nissan, Japanese brewer Asahi, U.S. newspaper publisher Lee Enterprises and Australia's Court Services Victoria. The attack on Asahi, Japan's largest beer producer, was especially damaging: it disrupted operations for an extended period and exposed personal details of 1.5 million people.

More recently the group struck the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). It has also been tied to the exploitation of Check Point VPN zero-days and known Palo Alto VPN flaws.

The gang keeps going

According to media reports, the alleged Qilin leader was actually detained back in May, at a hotel in Osaka. Even so, that did little to slow the group down: since June it has listed more than 450 new victims on its data leak site.

Source: Bleeping Computer