Germany arrests alleged core Qilin ransomware member after extradition

By Bill Toulas

• October 9, 2026
• 11:38 AM
• 0

Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month.

Japan has confirmed the extradition to Germany, with the National Police Agency saying that the suspect was detained after arriving in the country as a tourist.

“When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition,” [machine translated] reads the  press release.

Earlier this week, Japanese media reported the arrest based on internal sources, but authorities in the country have now officially confirmed the action.

Qilin is a notorious ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda, and deployed typical double-extortion attacks, where data is stolen before being encrypted.

The operation became one of the most active ransomware threats worldwide. By more recent statistics, the group targeted more than 2,350 known organizations across 62 countries.

Among the victims are Japanese automaker Nissan, Japanese brewery Asahi, U.S. newspaper publisher Lee Enterprises, and Australia’s Court Services Victoria.

The attack on Asahi, Japan’s largest beer producer, was particularly damaging, disrupting operations for an extended period and exposing sensitive details about 1.5 million people.

More recently, the threat group hit the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and was also linked to the exploitation of Check Point VPN zero-days and Palo Alto VPN n-day flaws.

According to media publications, Japan detained the alleged Qilin leading member in May at a hotel in Osaka. Despite this, the gang continued to be a major player on the ransomware stage. Since June, the group has listed more than 450 victims on its data leak site.

.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Related Articles:

Hackers arrested over €30M bank fraud exploiting service provider flaw

Ransomware attack disrupts Japan's IDCF Cloud used by govt clients

Japan's Keio confirms ransomware attack disrupted business systems

Berlin confirms data theft after Rhysida ransomware attack claims

ATF confirms “major incident” after recent Qilin breach claims