Qilin Ransomware Group Targets German Political Party Die Linke, Claiming 1.5 Terabytes of Stolen Data
Qilin ransomware group claims attack on German political party Die Linke, threatening to leak 1.5 terabytes of internal data in what the party calls a hybrid warfare operation.
The Qilin ransomware group has claimed responsibility for a cyberattack on Die Linke, one of Germany’s major political parties, adding the organization to its dark web leak site on April 1 after gaining access to internal systems days earlier. The incident marks a notable escalation in ransomware operations targeting political institutions in Europe.
The Attack
Die Linke, a democratic socialist party with approximately 123,000 registered members and 64 representatives in the Bundestag, disclosed the incident on March 27, one day after the attackers compromised its network. The party’s IT infrastructure was immediately disconnected from the network in response.
According to the party’s federal managing director, the attackers targeted sensitive data from internal areas of the party organization as well as personal information of employees at the party headquarters. However, Die Linke confirmed that its membership database was not compromised and that the attackers failed in their effort to obtain member data.
On April 1, Qilin publicly claimed the attack by listing Die Linke on its Tor-based data leak site. The group reportedly claimed to have exfiltrated approximately 1.5 terabytes of data but did not publish any data samples as proof of the breach, a tactic commonly used as leverage in ransom negotiations.
Hybrid Warfare Concerns
Die Linke described the threat actor behind the attack as a presumably Russian-speaking cybercrime organization whose activities could be both financially and politically motivated. The party’s leadership stated that the attack does not appear to be coincidental, framing the incident in the context of hybrid warfare.
The party warned that such digital attacks, and ransomware use in particular, are often part of hybrid warfare strategies where data collection and publication serve to intimidate, harass, or publicly discredit affected parties and weaken democratic structures. This characterization follows similar cyberattacks against rival German political parties in 2023 and 2024.
Die Linke has filed a criminal complaint with German police, notified relevant data protection authorities, and entered close coordination with security agencies. The party is also working with independent IT experts to restore systems safely.
Qilin’s Growing Threat Profile
The attack on Die Linke comes amid a period of significant growth for the Qilin ransomware operation. Formerly known as Agenda, the group emerged in mid-2022 and has since become one of the most active ransomware-as-a-service platforms in the threat landscape.
According to Infosecurity Magazine, Qilin has been publishing over 40 victim listings per month on its leak site, with peaks reaching 100 postings in both June and August 2025. The group operates a double-extortion model, encrypting victim data while simultaneously threatening to leak stolen information if ransom demands are not met.
Qilin’s primary targets have been concentrated in the manufacturing sector, which accounts for roughly 23 percent of incidents, followed by professional and scientific services at 18 percent and wholesale trade at 10 percent. The group’s geographic reach spans the United States, Canada, the United Kingdom, France, and Germany.
Technical analysis of Qilin’s operations has revealed the use of tools including Mimikatz and NirSoft utilities for credential theft, Cyberduck for data exfiltration via cloud services, and obfuscated PowerShell scripts to disable Windows security features. Some attacker scripts have contained Cyrillic character encoding, consistent with the assessment that the operation has ties to Eastern European or Russian-speaking actors.
Broader Implications
The targeting of a political party represents a departure from Qilin’s typical focus on commercial and industrial victims. While the group’s financial motivations remain evident through its ransomware-as-a-service model, the attack on Die Linke raises questions about whether political entities are becoming deliberate targets for groups that blend criminal enterprise with geopolitical objectives.
Germany has experienced a series of cyber incidents affecting its political institutions in recent years. The Die Linke breach adds to a growing pattern of ransomware groups expanding their target selection beyond traditional commercial victims to include organizations that hold politically sensitive data.