Europol bounty for Russian crypto ransomware gang wasn’t real

A $50,000 bounty supposedly issued by Europol to help track down administrators of the Russian-based ransomware gang Qilin was actually just a Telegram scam.

News of the fictitious bounty fooled several cybersecurity news outlets into reporting that a reward would be paid to anybody who could give Europol information on two Qilin administrators known as Haise and XORacle.

The pair supposedly “coordinate affiliates and oversee extortion activities,” and Europol wanted information that “directly leads to the identification or location of these administrators.”

However, Europol confirmed to SecurityWeek that the supposed reward was a “scam” and that the agency never announced the bounty.

Not only that, the only social media channels run by Europol can be found on Facebook, Instagram, Bluesky, X, YouTube, and LinkedIn.

SecurityWeek notes that a rival gang may have created the fake bounty to damage a rival’s reputation, steal their affiliates, or create paranoia within the gang.

Qilin attacks national security for crypto

Qilin is a prominent ransomware gang that extorts crypto, including bitcoin and monero, through its ransomware-as-a-service.

In March this year, Qilin claimed to have stolen and sold data including “private correspondence, personal information, decrees etc,” from the Ukrainian Ministry of Foreign Affairs.