< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [CRIME]

2 clusters · 25 sources · 3 days · First seen · Last updated

German arrest of Qilin ransomware group member

Overview

German authorities in North Rhine-Westphalia have arrested and extradited a key member of the Russian ransomware group Qilin. The suspect, a 28-year-old Russian national known by the pseudonym ‘Snake’, was apprehended in Osaka, Japan, while on vacation in May and extradited to Germany last Friday.

The arrest is the result of ‘Operation Albus,’ a months-long investigation involving the State Criminal Police Office and the Central and Contact Point for Cybercrime (ZAC). Investigators believe the suspect was responsible for building the group’s attack infrastructure. The operation involved extensive international cooperation between German investigators and Japanese authorities, including the National Police Agency and the Tokyo High Public Prosecutors Office.

Qilin is identified as a highly active cybercriminal organization that has targeted nearly 4,000 companies globally since 2024, with ransom demands totaling approximately $3 billion. In Germany, the group has targeted 150 entities, including 30 in North Rhine-Westphalia. Interior Minister Herbert Reul described the arrest as the most significant blow to German investigators in the fight against cybercrime to date.

Entities

Herbert Reul · Japan · North Rhine-Westphalia · Benjamin Limbach · Qilin

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [CRIME] 6 sources
    Germany arrests suspected Qilin ransomware leader extradited from Japan

    A suspected leader of the Qilin ransomware group, a 28-year-old Russian national, has been extradited from Japan to Germany following an international investigation into global cyberattacks.

  2. [CRIME] 19 sources
    Qilin hacker arrested in Japan and extradited to Germany

    A 28-year-old Russian member of the Qilin ransomware group was arrested in Tokyo and extradited to Germany following a months-long infiltration operation by German cybercrime investigators.

Sources

abcnews.al · abendblatt.de · aktual24.ro · businessdaily.gr · cnn.gr · dattelner-morgenpost.de · finance.technews.tw · finanzen.at · halternerzeitung.de · heute.de · it-boltwise.de · japantimes.co.jp · kreiszeitung.de · kurierverlag.de · leinetal24.de · merkur-online.de · op-online.de · recklinghaeuser-zeitung.de · saarbruecker-zeitung.de · saferworld.org.uk · securityaffairs.com · tromaktiko.gr · tz.de · volksfreund.de · waltroper-zeitung.de

This summary has been updated 1 time: see revision history