Japanese authorities have arrested a Russian national accused of being a leading member of the Qilin ransomware gang and extradited the suspect to Germany, Japan’s National Police Agency has confirmed. The case was reported by BleepingComputer and by The Record from Recorded Future News on October 9.
A vacation that ended in an arrest
According to The Record, citing Nippon.com, officials learned in May that the suspect planned to visit Japan on vacation. The suspect, described as a 28-year-old Russian national, was arrested at a hotel in Osaka in May. Japan’s National Police Agency said the person arrived in Japan as “a Russian national for whom Germany had obtained an arrest warrant.”
Japan detained the suspect under its Extradition Law for Fugitives using a provisional detention warrant, with the Ministry of Justice and the Tokyo High Public Prosecutors Office working alongside German authorities. The German warrant relates to a ransomware attack on a German company.
Reports differ on the timing of the transfer. The Record says the suspect was sent to Germany in June, while BleepingComputer describes the extradition as taking place earlier this month. The suspect’s name and the specific charges have not been made public, and German law enforcement did not respond to The Record’s request for comment.
Who is Qilin?
Qilin is a ransomware-as-a-service operation. In this model, a core team builds and maintains the malware and the infrastructure, while “affiliates” carry out the actual break-ins and split the ransom payments with the operators. That makes arrests of core members significant, since they keep the whole operation running.
The group emerged in August 2022 under the name Agenda and uses double extortion: it steals data before encrypting a victim’s systems, then threatens to publish the stolen files if the ransom is not paid. According to statistics cited by BleepingComputer, Qilin has targeted more than 2,350 known organizations in 62 countries. Researchers cited by The Record said it was the second most active ransomware gang in July 2026, with 127 reported attacks.
Its past victims include the Japanese beverage company Asahi, whose 2025 attack disrupted operations for an extended period and exposed information on about 1.5 million people, as well as Nissan, Lee Enterprises and Court Services Victoria. In August 2026, the group claimed an attack on the US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF).
A busy month for ransomware arrests
The arrest adds to a string of law enforcement actions against ransomware groups. Earlier this month, an international police operation dismantled the KillSec ransomware gang, whose suspected leader is 16. Ransomware attacks on critical services also continue, including the Warlock ransomware breaches of a water utility and a telecom provider we reported on October 3.
Sources
- BleepingComputer: Germany arrests alleged core Qilin ransomware member after extradition (October 9, 2026)
- The Record from Recorded Future News: Japan confirms arrest of Russian Qilin operative, extradition to Germany (October 9, 2026)
