Following an extradition from Japan earlier this month, German authorities have taken into custody a Russian citizen thought to be a key figure in the Qilin ransomware organization.
Japan's National Police Agency confirmed the transfer, noting that the individual was apprehended upon entry to the country in the capacity of a tourist.
When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition.
Japan's National Police Agency
Japanese news outlets had reported the detention based on unnamed sources earlier in the week, but the official acknowledgment came only after authorities made their public statement.
Qilin operates as a ransomware-as-a-service platform that first surfaced in August 2022 under the initial designation Agenda. The operation employs double-extortion methodology, stealing data before encrypting systems to maximize pressure on victims.
The gang has grown into one of the most prolific ransomware threats globally. Current tallies indicate the group has targeted upwards of 2,350 documented organizations spanning 62 nations.
Qilin's victim roster includes major corporations and institutions such as Japanese carmaker Nissan, Japanese brewer Asahi, U.S. newspaper chain Lee Enterprises, and Australia's Court Services Victoria.
The Asahi incident proved particularly destructive for Japan's leading beer manufacturer, causing extended operational disruption and compromising personal information belonging to approximately 1.5 million individuals.
In recent months, Qilin has struck the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and has been connected to attacks leveraging zero-day vulnerabilities in Check Point VPN products as well as n-day flaws affecting Palo Alto VPN systems.
According to reporting, the suspected Qilin leader was apprehended by Japanese authorities in May at an Osaka hotel. Despite this detention, the organization maintained its prominence in the ransomware landscape, with more than 450 fresh victim listings appearing on its data leak platform since June.