Germany arrests alleged core Qilin ransomware member after extradition

Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month.

Japan has confirmed the extradition to Germany, with the National Police Agency saying that the suspect was detained after arriving in the country as a tourist.

“When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition,” [machine translated] reads the  press release.

Earlier this week, Japanese media reported the arrest based on internal sources, but authorities in the country have now officially confirmed the action.

Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda, and deployed typical double-extortion attacks, where data is stolen before being encrypted.

The operation became one of the most active ransomware threats worldwide. By more recent statistics, the group targeted more than 2,350 known organizations across 62 countries.

Among the victims are Japanese automaker Nissan, Japanese brewery Asahi, U.S. newspaper publisher Lee Enterprises, and Australia’s Court Services Victoria.

The attack on Asahi, Japan’s largest beer producer, was particularly damaging, disrupting operations for an extended period and exposing sensitive details about 1.5 million people.

More recently, the threat group hit the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and was also linked to the exploitation of Check Point VPN zero-days and Palo Alto VPN n-day flaws.

According to media publications, Japan detained the alleged Qilin leading member in May at a hotel in Osaka. Despite this, the gang continued to be a major player on the ransomware stage. Since June, the group has listed more than 450 victims on its data leak site.