Germany arrests alleged Qilin ransomware member extradited from Japan

The arrest and extradition

A 28-year-old Russian national, believed to be a core member of the Qilin ransomware group, was arrested in Osaka, Japan, in May 2026. Japanese police identified his location after learning he planned to visit as a tourist. The arrest was the result of cooperation between Japan’s National Police Agency and local police departments in Tokyo, Osaka and Kyoto. In October 2026, the suspect was handed over to German authorities following a decision by the Tokyo High Court under Japan’s extradition law. German police had obtained an arrest warrant on suspicion of extortion, specifically for hacking into German companies and demanding cryptocurrency payments.SecurityWeek↗ (opens in a new tab) Japan Times↗ (opens in a new tab)

Qilin’s global impact

Qilin, also known as Agenda, has been active since at least August 2022. It operates as a ransomware-as-a-service (RaaS) group, where core members develop malware and manage systems, while affiliates carry out attacks. The group has targeted thousands of organisations worldwide, including logistics companies, hospitals, schools and major corporations. According to Japanese police, Qilin has affected about 4,000 companies globally and has demanded ransom payments to restore access to encrypted data. If victims refuse to pay, the group threatens to leak stolen information.

Qilin has been linked to several high-profile incidents. In 2024, it was blamed for an attack on Synnovis, a pathology lab services provider, which caused disruptions at multiple London hospitals. In 2025, the group claimed responsibility for hacking Asahi Group Holdings, compromising the personal information of roughly two million people. Qilin’s leak site has listed hundreds of victims, including Lee Enterprises and Inotiv, a pharmaceutical company.

How Qilin operates

Qilin uses ransomware to encrypt files on victims’ computers, making them inaccessible. The group then demands payment, usually in cryptocurrency, in exchange for the decryption key. If the ransom is not paid, Qilin threatens to publish stolen data on its leak site. The group has also exploited software vulnerabilities, such as a critical authentication bypass in Check Point VPN and firewall products (CVE-2026-50751), to gain access to targets’ systems.

Qilin’s structure is typical of modern ransomware groups. Core members handle malware development and infrastructure, while affiliates are responsible for carrying out attacks and extortion attempts. This model allows the group to scale its operations and target a wide range of organisations.

International cooperation and significance

The arrest is notable for the level of international cooperation involved. Japanese and German authorities worked together to track, detain and extradite the suspect. A senior official from Japan’s National Police Agency described the identification and arrest as significant, given the global reach of Qilin’s attacks.

While the arrest is a step forward, Qilin remains active, with many affiliates and core members still at large. The group’s ability to operate across borders highlights the challenges law enforcement faces in tackling ransomware.

What organisations can do

Ransomware remains a major threat to organisations of all sizes. Defenders should ensure regular backups, keep software up to date, and train staff to recognise phishing attempts. Monitoring for suspicious activity and having an incident response plan are also key. Organisations should be aware of vulnerabilities in widely used products, such as VPNs and firewalls, and apply patches promptly.

Previous incidents and ongoing risk

Qilin’s attacks have caused millions of dollars in damages and disrupted critical services. The group’s continued activity, despite high-profile arrests, shows that ransomware remains a persistent risk. Organisations should remain vigilant and invest in both prevention and response capabilities.