Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group after Japan extradited him earlier this month.

 

What happened

Japan has confirmed the extradition to Germany. The National Police Agency said authorities detained the suspect after he arrived in the country as a tourist. Germany had obtained an arrest warrant for the man in connection with a ransomware incident in Germany. Japanese media reported the arrest earlier this week, citing internal sources. Japanese authorities have now officially confirmed it.

According to media publications, Japan detained the alleged Qilin leading member in May at a hotel in Osaka. Despite this, the gang still carried out ransomware attacks. Since June, the group has listed more than 450 victims on its data leak site.

Read also: Ransomware group profile: Qilin

 

Going deeper

Qilin is a ransomware-as-a-service (RaaS) operation that emerged in August 2022 under the name Agenda. The group used double-extortion attacks, stealing data before encrypting it.

Known victims include:

  • Japanese automaker Nissan
  • Japanese brewery Asahi
  • U.S. newspaper publisher Lee Enterprises
  • Australia’s Court Services Victoria
  • The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
  • Rocky Mountain Care, a Woods Cross, Utah-based provider of skilled nursing and home health services for seniors in Utah and Wyoming

In the Rocky Mountain Care incident, an investigation determined that someone viewed or took certain information without authorization between January 30 and February 2, 2026. Qilin then posted the provider to its dark web data leak site on February 23, 2026, demanded a ransom, and threatened to publish the stolen data if the provider did not pay.

 

What was said

In a press release, Japan’s National Police Agency described how the arrest unfolded. The release said, “When a Russian national for whom Germany had obtained an arrest warrant in connection with a ransomware incident in Germany arrived in Japan, the Japanese Ministry of Justice, the Tokyo High Public Prosecutors Office, and Germany worked together to detain the suspect under the Extradition Law for Fugitives by obtaining a provisional detention warrant, and then facilitated the extradition”

 

Why it matters

This arrest shows international cooperation can reach ransomware suspects even when they operate far from the victims. Japanese, German, and prosecutorial authorities worked together to detain and extradite the suspect.

The arrest has not stopped Qilin. Japan detained the alleged leading member in May, yet the group has listed more than 450 victims since June. That shows that removing one member does not put an end, or even significantly slow down, a RaaS operation.

 

The bottom line

Even with the arrest, Qilin keeps attacking, including healthcare providers like Rocky Mountain Care. Organizations should not count on law enforcement alone. They should patch VPN vulnerabilities promptly and put defenses in place that stop double-extortion attacks before data leaves their networks.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is ransomware-as-a-service (RaaS)?

RaaS is a business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out attacks and share the ransom payments with the developers.

 

What is a data leak site?

A data leak site is a dark web page where ransomware groups name their victims and post stolen data to pressure them into paying.

 

What is the difference between a zero-day and an n-day vulnerability?

A zero-day is a software flaw that attackers exploit before the vendor has released a fix, while an n-day is a known flaw with an available patch that attackers exploit because organizations have not yet applied it.

 

How can organizations reduce their risk of a ransomware attack?

Organizations can reduce their risk by patching vulnerabilities promptly, keeping offline backups, segmenting their networks, and testing an incident response plan.