Cybersecurity
Germany arrests suspected Qilin ransomware member
Germany detained a Russian national suspected of leading Qilin after extradition from Japan, while Japanese authorities described the cross-border detention and the group’s record of ransomware attacks.
- Germany arrested a Russian national suspected of being a leading member of Qilin after his extradition from Japan.
- Japan’s National Police Agency confirmed the extradition and said the suspect had been detained after arriving in the country as a tourist.
- Japanese authorities said the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany worked together to obtain a provisional detention warrant and carry out the extradition.
- The article said Qilin emerged in August 2022 under the name Agenda and used double-extortion attacks.
- It said the group had targeted more than 2,350 known organisations across 62 countries and had listed more than 450 victims on its leak site since June.
Germany arrested a Russian national whom it suspected of being a leading figure in Qilin after his extradition from Japan earlier in the month. Japan’s National Police Agency said he was detained after arriving in Japan as a tourist.
A Japanese government release said the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany worked together to secure a provisional detention warrant under the law on fugitives. Japanese media had reported the arrest earlier in the week before officials confirmed it.
The article said Qilin began in August 2022 as Agenda and carried out double-extortion attacks, in which data is stolen before encryption. It said more recent figures put the group at more than 2,350 known victim organisations in 62 countries.
The list of victims named Nissan, Asahi, Lee Enterprises and Court Services Victoria. It said the attack on Asahi disrupted operations and exposed details about about 1.5 million people.
The article also said Qilin later hit the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives and was linked to exploitation of Check Point and Palo Alto VPN flaws. Since June, it had listed more than 450 victims on its data leak site.
Named in this story
Companies
- Nissan
- was listed as one of Qilin’s victims
- Asahi
- was listed as one of Qilin’s victims
- Lee Enterprises
- was listed as one of Qilin’s victims
- Check Point
- its VPN zero-days were linked to Qilin exploitation
- Palo Alto
- its VPN flaws were linked to Qilin exploitation
Organisations
- Qilin
- the ransomware group linked to the suspect
- Agenda
- the name Qilin used when it first emerged
Governments and agencies
- Germany
- arrested the suspect after extradition
- Japan
- confirmed the extradition and coordinated the transfer
- National Police Agency
- said the suspect was detained after arriving in Japan
- Japanese Ministry of Justice
- helped secure the provisional detention warrant
- Tokyo High Public Prosecutors Office
- worked with Germany on the extradition
- Court Services Victoria
- was listed as one of Qilin’s victims
- U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives
- was hit by the group more recently
How the source tells it
The piece is written as straightforward crime reporting, but it repeatedly heightens the perceived menace of Qilin through loaded labels and large victim counts.
- alarm loaded labels are used for the group and its attacks
- threat inflation the story stresses scale with sweeping victim totals and superlatives