Germany Arrests Alleged Core Qilin Ransomware Member
A Russian national suspected of leading the notorious Qilin ransomware operation has been extradited from Japan and arrested in Germany following international law enforcement cooperation.
Radwan AbdulhadiEditor and technology writer
Extradition and Arrest Details
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month, as detailed in a report by <a href="https://www.bleepingcomputer.com/news/security/germany-arrests-alleged-core-qilin-ransomware-member-after-extradition/">BleepingComputer</a>.
Japan officially confirmed the extradition to Germany, with the National Police Agency stating that the suspect was detained after arriving in the country as a tourist. According to the official announcement, German authorities had obtained an arrest warrant in connection with a ransomware incident.
As <a href="https://www.npa.go.jp/news/release/2026/20261008news.pdf">reads the press release</a> from Japanese authorities, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant before facilitating the extradition.
Earlier in the week, Japanese media <a href="https://www.japantimes.co.jp/news/2026/10/06/japan/qilin-hacker-group-japan-germany/">reported</a> the arrest based on internal sources, but law enforcement authorities have now officially confirmed the action.
Overview of the Qilin Ransomware Operation
Qilin operates as a notorious ransomware-as-a-service (RaaS) threat that originally emerged in August 2022 under the name Agenda. The group is known for deploying typical double-extortion attacks, where sensitive data is exfiltrated before systems are encrypted.
Over time, the operation evolved into one of the most active ransomware threats worldwide. Recent statistics indicate that the group has targeted more than 2,350 known organizations across 62 countries.
Media publications noted that Japan initially detained the alleged Qilin leading member in May at a hotel in Osaka. Despite this detention, the gang continued its operations on the global ransomware stage, listing more than 450 victims on its data leak site since June.
High-Profile Global Victims
The Qilin cybercrime ecosystem has impacted numerous high-profile organizations globally across diverse sectors, including automotive manufacturing, food and beverage, publishing, and legal services.
Among the documented victims are Japanese automaker <a href="https://www.bleepingcomputer.com/news/security/nissan-confirms-design-studio-data-breach-claimed-by-qilin-ransomware/">Nissan</a>, Japanese brewery <a href="https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-asahi-brewery-attack-leaks-data/">Asahi</a>, U.S. newspaper publisher <a href="https://www.bleepingcomputer.com/news/security/qilin-ransomware-claims-attack-at-lee-enterprises-leaks-stolen-data/">Lee Enterprises</a>, and Australia’s <a href="https://www.bleepingcomputer.com/news/security/victoria-court-recordings-exposed-in-reported-ransomware-attack/">Court Services Victoria</a>.
The cyberattack targeting Asahi, recognized as Japan’s largest beer producer, proved particularly damaging by <a href="https://www.bleepingcomputer.com/news/security/japans-largest-brewer-suspends-operations-due-to-cyberattack/">disrupting operations</a> for an extended period and exposing sensitive personal details affecting <a href="https://www.bleepingcomputer.com/news/security/japanese-beer-giant-asahi-says-data-breach-hit-15-million-people/">1.5 million people</a>.
Recent Campaign Activity and Exploitation
In more recent campaigns, the threat group targeted the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives, with the <a href="https://www.bleepingcomputer.com/news/security/atf-confirms-major-incident-after-recent-qilin-breach-claims/">ATF</a> confirming a major incident following the group's breach claims.
Security researchers have also linked the Qilin network to broader exploitation tactics, including the targeting of Check Point VPN zero-days and Palo Alto VPN n-day vulnerabilities to gain unauthorized access to corporate networks.
Sources
- BleepingComputerGermany arrests alleged core Qilin ransomware member after extradition
Continue chronologically
Related stories
ASOS Confirms Cyberattack After Rogue In-App Notifications
British online retailer ASOS confirms a data breach following unauthorized push notifications sent to users via a compromised third-party platform.
Engineer Sentenced for Locking 3,000 Devices in Ransomware Plot
A former core infrastructure engineer was sentenced to 32 months in prison for locking thousands of devices on his employer network in an extortion scheme.
CISA Warns Ransomware Gangs Are Exploiting TeamCity Flaw
CISA alerts federal agencies that ransomware gangs are now actively exploiting a critical JetBrains TeamCity authentication bypass vulnerability.
Nikkei Discloses Third Data Breach in a Month
Japanese media giant Nikkei Inc. discloses its third data breach in a month, exposing 1.83 million personal records via a compromised development system.
