The Interior Minister of the German state of North Rhine-Westphalia, Herbert Reuel, announced today, Wednesday (October 7th), that the investigation authorities in the state were able to strike the Russian hacker group "Kilin", which is active around the world.
Reuel, who belongs to the Christian Democratic Party of Chancellor Friedrich Merz, said: “We arrested one of the most prominent leaders of the group, as we were able, with the help of the Japanese police, to arrest the 28-year-old Russian citizen in Tokyo last May,” noting that the man was transferred to Germany last Friday, describing this as a “historic success” in confronting the hacker group.
The suspect was arrested after his arrest in Tokyo
Rowell said the man had planned to spend a holiday in Japan in May, but was now in a German prison. “Instead of sushi, he is now eating cheeseburgers in a German prison,” he said.
Reuel stated that the group has blackmailed about 4,000 companies and institutions around the world since 2024, and stated that the number of targeted parties in Germany reached 150, including 30 parties in the state of North Rhine-Westphalia. “The unreported number is likely even higher,” Rowell said.
He added that the ransom demands amounted to approximately $3 billion, while more than $140 million had been paid. He described the "Kilin" group as "one of the most active and unscrupulous criminal gangs in the world."
Secret hacking of the group and tracking of cryptocurrency funds
In turn, the Minister of Justice in the state of North Rhine-Westphalia, Benjamin Limbach, who belongs to the Green Party, said that what happened was diligent and detailed work that enabled German investigators to track down the Russian hacker, pointing out that investigators from the branch of the Federal Office of Criminal Investigation in the state, the Central Office for Electronic Crimes, and the Communications Office concerned with these crimes were able to penetrate the hacker group and monitor it over a period of months.
Investigators have followed countless digital traces, Limbach said. He added: "In the end, a real name emerged behind the pseudonym." The two ministers thanked Japan for extraditing the Russian pirate to Germany, despite the absence of an extradition agreement between the two countries. They said that this proves the effectiveness of the global fight against cybercrime.
In the context of the details of the investigations revealed in Dusseldorf, investigators explained that the operation was carried out by the state Criminal Investigation Office (LKA) in cooperation with the Central Contact Point for Combating Cybercrime (ZAC), where experts were able to secretly infiltrate the hackers’ computers and monitor them for months, tracking their infrastructure and payment paths via cryptocurrencies, in a scene that the Minister of the Interior described as turning “hunters into prey.”
Thousands of victims and billions of dollars in ransom demands
According to what a Japanese newspaper reported from security sources, the arrested Russian citizen is suspected of involvement in an attack targeting a German logistics company with ransomware, where he blackmailed it and demanded about 150,000 euros in Bitcoin in exchange for not leaking its data.
The network's attacks were not limited to the commercial sector, but rather affected hospitals around the world, as well as prominent parties within the state of North Rhine-Westphalia, including the Bishops' Conference and the "Left" party.
For his part, Rowell described the group's criminal activity as competing in the "champions league" of crime, reiterating his call on companies to strengthen their cyber defenses and not yield to extortion demands. The minister stressed the need to inform the authorities immediately instead of paying money, warning that “whoever pays is feeding the monster that just bit him.”
