German police did something they had never managed before: they got inside one of the world's most prolific ransomware gangs.
On October 7, officials in North Rhine-Westphalia announced that investigators from the state's criminal police office and its central cybercrime unit had secretly infiltrated the Qilin ransomware network and observed it for months, calling the operation a historic first.
The announcement came alongside news that a 28-year-old Russian national described as one of the leading heads of Qilin is now in a German prison, after Japan handed him over despite the two countries having no extradition treaty.
Interior Minister Herbert Reul credited Japanese police with the May arrest, noting the suspect had been detained while on holiday in Japan.
A historic infiltration
For the first time, investigators successfully penetrated such a criminal network, Reul said, describing months of covert monitoring of the group's activities.
He and Justice Minister Benjamin Limbach announced the case in Dusseldorf, thanking Japan for the handover and declining to share further details while the investigation continues.
The case began with an attack in September 2024 on a company in North Rhine-Westphalia, in which the attackers stole and encrypted data and threatened to publish it unless a ransom was paid.
That single incident opened the door to the wider operation against the gang's leadership.
The arrest in Osaka
The Russian suspect was detained in Osaka in late May after Japanese investigators received a tip that a core Qilin member was traveling in the country.
According to reporting citing the Asahi Shimbun, he was responsible for building or maintaining the infrastructure used in Qilin attacks and received a share of the ransom proceeds.
Germany had an open investigation into the September 2024 intrusion at a German logistics company, in which attackers encrypted company data and demanded roughly 26 million yen, about $165,000, in Bitcoin.
The Tokyo High Court cleared the extradition, and the suspect was transferred to German custody on October 2.
On October 8, Japan's National Police Agency described him as a Russian national believed to have led Qilin, crediting its Kanto cyber unit's cooperation with German authorities.
The gang keeps running
Officials presented the scale of the threat in stark numbers: since 2024, Qilin has extorted nearly 4,000 companies and institutions worldwide, including about 150 in Germany and 30 in North Rhine-Westphalia.
Its ransom demands total nearly $3 billion, of which more than $140 million has actually been paid.
Still, the arrest has not stopped the operation. No infrastructure takedown was announced alongside the custody transfer, and the gang's ransomware-as-a-service model appears to be running unabated, with more than 150 new victims listed in August alone.
For defenders, the message is mixed: investigators can now get inside these networks, but the business of ransomware keeps moving without missing a beat.
By Hamza Faisal
