Alleged top member of Russian Qilin hacker group extradited to Germany

Authorities in North Rhine-Westphalia have announced a significant breakthrough in their ongoing investigation into the Russian hacker group Qilin, with the arrest and extradition of an alleged leading member. The 28-year-old Russian suspect was apprehended in Tokyo with the assistance of Japanese police in May and has been extradited to Germany as of last Friday, according to Herbert Reul, North Rhine-Westphalia's interior minister.

Minister Reul described the Qilin network as one of the most notorious and aggressive hacking collectives globally. "We have captured one of the masterminds," Reul stated at a press briefing in Düsseldorf. The arrest followed a series of covert operations by the state’s criminal investigation authorities, who had infiltrated the hackers' systems over several months.

The group reportedly targeted a wide range of organizations with ransomware attacks, demanding large sums of money for the non-disclosure of stolen data. In one notable case cited by a Japanese newspaper, the suspect allegedly orchestrated a ransomware attack against a German logistics company, demanding nearly 150,000 euros in Bitcoin for data secrecy.

Qilin has been under investigation by North Rhine-Westphalia's law enforcement agencies for months. Reul noted that the group has attacked almost 4,000 entities worldwide since 2024, including agencies, businesses, and health care facilities, with 30 of these attacks occurring in North Rhine-Westphalia. Victims of the attacks have reportedly paid approximately 140 million euros, marking it as a significant criminal enterprise.

The efforts to disrupt Qilin's activities involved both the State Office of Criminal Investigations and the Central and Contact Point Cybercrime, who worked together to infiltrate the hackers' operations. By accessing the criminals' computers undetected, investigators were able to analyze the group's infrastructure and trace cryptocurrency payment flows.

Reul acknowledged the collaboration with international law enforcement, particularly noting the support provided by Japanese officials. The suspect, who had allegedly been in Japan for a vacation, now finds himself detained in a North Rhine-Westphalian correctional facility awaiting legal proceedings.

The arrest is counted as a historical milestone by Reul and his team, who regard this as a substantial blow to the hacker group. "The hunters have become the hunted," Reul remarked, expressing satisfaction with the innovative probing tactics employed by the cybercrime specialists, which led to the successful capture and extradition.

Qilin's capabilities have been likened to a 'Champions League' level by Reul, who emphasized the magnitude of financial losses attributed to their ransomware strategies. The Northrhine-Westphalian Ministry remains committed to pursuing cyber criminals and safeguarding digital infrastructure from such harmful activities.

The unfolding of this operation showcases the ongoing global coordination required to combat cybercrime and disrupt criminal networks that thrive on technological sophistication and transnational resources.

Source: tagesschau.de