German authorities have arrested a Russian national suspected of being a key figure in the Qilin ransomware group. The individual was initially detained in Japan in May while traveling as a tourist in Osaka, following an arrest warrant issued by Germany in connection with a ransomware incident on German soil.
Japan's National Police Agency (NPA) confirmed its role in the arrest and extradition. The NPA, in cooperation with Japan's Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities, detained the suspect under a provisional detention warrant in accordance with Japan's Act of Extradition. The suspect was subsequently handed over to Germany through established legal procedures.
The NPA emphasized the importance of international cooperation in combating cybercrime, particularly ransomware attacks that impact multiple countries. The agency also highlighted the contributions of the Kanto Regional Police Bureau’s Cyber Special Investigation Unit and other local police forces, which had been investigating Qilin ransomware attacks within Japan and collaborating with German investigators.
Qilin ransomware has been active since 2022 and emerged as a prominent Ransomware-as-a-Service (RaaS) group in 2025. The group employs double-extortion tactics, encrypting victim data and threatening to leak it on Tor-based portals. Qilin enables affiliates to deploy customized ransomware payloads and has targeted various sectors globally, including healthcare, manufacturing, and finance, often leveraging phishing and known vulnerabilities.
Japanese organizations have been direct victims of Qilin attacks. Notably, carmaker Nissan and brewing company Asahi have been impacted. The attack on Asahi resulted in prolonged operational disruptions and the exposure of data belonging to 1.5 million individuals.
Despite the suspect's detention in May, the Qilin ransomware group has continued its operations. Its Tor leak site has listed hundreds of new victims since June alone. In October 2025, Resecurity researchers detailed Qilin's reliance on global bulletproof hosting networks for its extortion activities. More recently, in early October, Qilin reportedly formed a ransomware alliance with DragonForce and LockBit, aiming to share tools and infrastructure to enhance attack effectiveness. In late March, the group allegedly breached chemical manufacturing giant Dow Inc.
