Germany Arrests Suspected Leader of Qilin Ransomware Gang After Extradition From Japan
A 28-year-old Russian national was picked up at an Osaka hotel in May. German investigators say they secretly infiltrated the group before the arrest.
Germany announced Wednesday that it has arrested a Russian national suspected of being one of the leading figures in the Qilin ransomware group. The 28-year-old was detained in Japan in May and handed over to Germany earlier this month.
The man was on vacation in Osaka when Japanese authorities picked him up at his hotel. Germany had already issued an arrest warrant for him over a ransomware attack on a German company. Japan's National Police Agency said its Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities worked together to detain him under Japan's extradition law. Japan has no bilateral extradition treaty with Germany.
The announcement came Wednesday at a press conference in Düsseldorf. North Rhine-Westphalia interior minister Herbert Reul and justice minister Benjamin Limbach said the case started with a September 2024 attack on a company in the state. Investigators said data was stolen and encrypted, and the attackers threatened to publish it.
While pursuing the case, investigators from the state's criminal police office and its central cybercrime unit secretly infiltrated Qilin and watched the group for months, Reul said. He called it the first time German authorities have infiltrated such a network and described the success as historic. Reul said the suspect is one of the group's leading heads. The suspect's name has not been released.
Reul said Qilin has extorted nearly 4,000 companies and institutions worldwide since 2024, including about 150 in Germany. The group's ransom demands total nearly $3 billion, and more than $140 million has been paid, he said.
Qilin is a ransomware-as-a-service operation that first emerged in 2022 under the name Agenda. It uses double extortion: stealing data before encrypting systems, then threatening to publish what it stole. Reported victims include automaker Nissan, Japanese brewery Asahi, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives.
Despite the arrest, the group kept attacking victims afterward, security researchers said. German officials said the investigation is continuing and declined to release further details.
