Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
An alleged core member of the Qilin ransomware operation has been arrested in Japan and extradited to Germany to face hacking charges.
An alleged member of the prolific Qilin ransomware group, also known as Agenda, has been arrested in Japan and extradited to Germany. The 28-year-old Russian national was detained in Osaka in May and reportedly handed over to German authorities on October 2nd, facing charges related to a September 2024 cyberattack.
German authorities accuse the suspect of hacking into a logistics company, encrypting its data, and extorting over $160,000 in cryptocurrency. This arrest marks a significant international law enforcement success against a major ransomware-as-a-service (RaaS) operation.
Qilin has been active since August 2022 and has targeted hundreds of organizations globally, causing millions of dollars in damages. The group has been linked to several high-profile attacks in 2024, including a breach at Synnovis, a pathology lab services provider, which led to disruptions at multiple London hospitals run by the National Health Service.
Last year, Qilin claimed responsibility for a significant attack on beer giant Asahi Group, compromising the personal information of approximately 2 million individuals and causing operational disruptions. Throughout 2025, the group listed an estimated 400 victims on its Tor-based leak site, including notable entities like Lee Enterprises and the pharmaceutical company Inotiv.
The ransomware group has also been observed exploiting critical vulnerabilities. In June 2026, Qilin was actively exploiting a critical authentication bypass vulnerability in Check Point VPN and firewall products, identified as CVE-2026-50751. More recently, in August 2026, the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed it was a victim after Qilin added the agency to its leak site.
The extradition and arrest underscore the ongoing global efforts to dismantle ransomware operations and bring cybercriminals to justice. International cooperation between law enforcement agencies is crucial in combating sophisticated cyber threats like those posed by the Qilin ransomware group, which has demonstrated a persistent ability to compromise high-value targets and inflict significant financial and operational damage.