Germany extradites alleged Qilin ransomware leader from Japan

German authorities said this week that they have taken custody of a 28-year-old Russian man extradited from Japan on suspicion of being a core member of Qilin, one of the world's most prolific ransomware operations, in what officials called the first arrest to reach inside the group's inner leadership. North Rhine-Westphalia's interior minister, Herbert Reul, and its justice minister, Benjamin Limbach, announced the handover at a news conference in Düsseldorf on Wednesday, describing a joint statement from the state's interior and justice ministries that followed months of covert monitoring in which investigators read the suspect's private communications before he traveled abroad.

German investigators say Qilin has attacked nearly 4,000 companies and institutions worldwide since 2024, including roughly 150 victims in Germany and about 30 in North Rhine-Westphalia alone. Across its campaigns, the group has demanded close to $2.9 billion in ransom and collected more than $140 million in actual payments, officials said at the briefing. Separately, Japan's National Police Agency said in a statement released Thursday that 53 organizations in Japan, including manufacturers, service firms, builders, hospitals and schools, have been hit by Qilin since April 2023.

Qilin, which also operates under the name Agenda, has run as a ransomware-as-a-service platform since 2022, renting its malware and leak-site infrastructure to outside hacking crews in exchange for a share of any ransom collected. The arrangement has made it difficult for any single law-enforcement action to shut the operation down, since the affiliate groups that carry out individual break-ins are scattered across multiple countries and can continue operating even if parts of the core leadership are removed.

A years-long infiltration

The suspect, identified by investigators only by the alias "Snake," is accused of helping build the malware and attack infrastructure used by Qilin's roughly eight-person core group, which officials say supplies tools to several hundred affiliate hacking crews and takes a cut of whatever ransom those crews collect. German prosecutors tied him specifically to a September 2024 intrusion at a logistics company in North Rhine-Westphalia, in which attackers stole and encrypted company data and extorted roughly $160,000 in cryptocurrency.

Investigators with North Rhine-Westphalia's state criminal police office and its cybercrime unit, ZAC NRW, said they secretly infiltrated the group and monitored its communications for months. That access, officials said, surfaced private messages about a planned trip abroad. Japan's National Police Agency, coordinating with police in Tokyo, Osaka and Kyoto, located the suspect at a hotel in Osaka in May and took him into custody. He remained in Japanese detention until October 2, when he was handed over to German authorities after Tokyo's High Court approved the extradition under Japanese law, despite the absence of a bilateral extradition treaty between Japan and Germany.

A reach that extends to a US federal agency

Qilin's victim list runs well beyond Germany and Japan. The group claimed responsibility in 2024 for an attack on pathology lab provider Synnovis, which disrupted several London hospitals run by Britain's National Health Service, and it took credit in 2025 for a breach at Japan's Asahi Group Holdings that exposed personal data belonging to roughly 2 million people.

In August, Qilin listed the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives on its dark-web leak site. The agency subsequently confirmed what it called a "major incident", saying a standalone computer system containing information on investigation targets had been breached but that its case-management, laboratory and eForms systems were unaffected. The Justice Department said it was coordinating the agency's response, and neither the ATF nor the department has said whether that breach is connected to the suspect now in German custody.

Qilin affiliates have also been linked to the exploitation of a critical authentication-bypass flaw in Check Point's remote-access VPN software, tracked as CVE-2026-50751, which Check Point disclosed and patched earlier this year after confirming active exploitation tied to a Qilin ransomware affiliate. The U.S. Cybersecurity and Infrastructure Security Agency ordered federal civilian agencies to remediate the flaw within days, underscoring how Qilin's affiliate network has continued to reach American networks even as the group's core leadership came under pressure.

'A name behind the pseudonym'

Reul described the arrest as a breakthrough, telling reporters it marked the first time German investigators had successfully infiltrated a network of Qilin's scale. Limbach, the justice minister, credited the breakthrough to painstaking digital forensic work, saying investigators had pieced together a real identity behind an online handle.

"You can no longer feel safe. We might already be standing at your door soon," Reul and Limbach said in their joint statement, addressing other suspected Qilin members.

Neither minister disclosed the suspect's full name, in keeping with German privacy rules that typically shield suspects' identities pending trial. German news outlets, including public broadcaster ZDF, reported that he is a Russian national who had traveled to Japan as a tourist when he was detained.

What happens next

The suspect is now in German custody and is expected to stand trial on charges related to computer sabotage and extortion, according to officials. Investigators said they have identified three other individuals believed to make up Qilin's remaining core leadership, all thought to be based in Russia, and that an international search for them is continuing. Germany and Russia have no extradition arrangement, which is likely to complicate any effort to bring those suspects to trial.

Security researchers who track ransomware-as-a-service operations caution that removing individual leaders rarely shuts such groups down outright, since the affiliate crews that actually carry out intrusions can regroup under new branding or migrate to rival platforms. Qilin's leak site remained active in the days following the announcement, and officials in Düsseldorf acknowledged that monitoring the group's remaining affiliates would continue regardless of the outcome of the extradited suspect's case.