Germany arrests alleged core Qilin ransomware member after extradition
Germany arrested an alleged core Qilin ransomware member, a Russian national extradited from Japan, over a ransomware attack in Germany.
Germany arrested a Russian national suspected of being a leading Qilin ransomware-as-a-service member following extradition from Japan, which detained him in May at an Osaka hotel under a provisional warrant. Qilin has targeted more than 2,350 organizations across 62 countries, including Nissan, Asahi, Lee Enterprises, Australia's Court Services Victoria, and the U.S. ATF. The group remained highly active, listing more than 450 victims on its leak site since June, and was linked to exploiting Check Point VPN zero-days and Palo Alto VPN n-days.
- Russian national extradited from Japan and arrested in Germany over Qilin ransomware attack
- Qilin RaaS has hit 2,350+ organizations across 62 countries since 2022
- Group listed 450+ victims on leak site since June despite the arrest
- Notable victims include Nissan, Asahi, Lee Enterprises, ATF, Court Services Victoria
Full article375 words · extracted from bleepingcomputer.com · click to collapse
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month.
Japan has confirmed the extradition to Germany, with the National Police Agency saying that the suspect was detained after arriving in the country as a tourist.
“When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition,” [machine translated] reads the press release.
Earlier this week, Japanese media reported the arrest based on internal sources, but authorities in the country have now officially confirmed the action.
Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda, and deployed typical double-extortion attacks, where data is stolen before being encrypted.
The operation became one of the most active ransomware threats worldwide. By more recent statistics, the group targeted more than 2,350 known organizations across 62 countries.
Among the victims are Japanese automaker Nissan, Japanese brewery Asahi, U.S. newspaper publisher Lee Enterprises, and Australia’s Court Services Victoria.
The attack on Asahi, Japan’s largest beer producer, was particularly damaging, disrupting operations for an extended period and exposing sensitive details about 1.5 million people.
More recently, the threat group hit the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and was also linked to the exploitation of Check Point VPN zero-days and Palo Alto VPN n-day flaws.
According to media publications, Japan detained the alleged Qilin leading member in May at a hotel in Osaka. Despite this, the gang continued to be a major player on the ransomware stage. Since June, the group has listed more than 450 victims on its data leak site.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.