Qilin ransomware suspect arrested in Japan and handed over to Germany

On October 7, at a press conference in Düsseldorf, Herbert Reul and Benjamin Limbach, the interior and justice ministers of the German state of North Rhine-Westphalia (NRW), announced the arrest of a 28-year-old Russian national. He is described as one of the leading members of the Qilin ransomware group. The suspect was apprehended in Japan in May while on vacation, then handed over to Germany. On October 8, Japan's National Police Agency confirmed the arrest and extradition. He has not been tried and is presumed innocent.

An investigation that began with an attack on a German company

According to ZDFheute, the investigation was led by the state criminal police office (LKA NRW) and the prosecutors' cybercrime unit (ZAC NRW). It began after an attack on an NRW company in September 2024, in which data was stolen and then encrypted. According to The Insider, citing Der Spiegel, the victim was a logistics company, which was asked to pay a $165,000 ransom in bitcoin.

Investigators say they infiltrated the group's network. Herbert Reul called it a “historic blow” and said it was the first time such a network had been successfully infiltrated. Also according to The Insider, they reportedly gained access to the suspect's computer and learned of his travel plans to Japan. Japan and Germany have no bilateral extradition treaty, but the handover was possible after a judicial review.

The suspect's exact role remains to be established. According to Japanese media cited by ZDFheute, he allegedly designed the attack systems and received a share of the ransoms. According to Der Spiegel, cited by The Insider, he was mainly a developer for the group.

Qilin, one of the most active ransomware groups

Qilin emerged in 2022 under the name Agenda. It operates as a “ransomware-as-a-service” (RaaS): its operators lease their software to affiliates, who carry out the attacks in exchange for a commission. The group uses double extortion: it steals data before encrypting it, then threatens to publish it.

According to figures presented by German authorities and reported by ZDFheute, nearly 4,000 companies have allegedly been victims of the group worldwide since 2024, including about 150 in Germany and around thirty in NRW. Ransom demands reportedly total nearly $3 billion, of which more than $140 million was allegedly actually paid.

What to do

An arrest, even of an important member, does not stop a ransomware service that relies on many affiliates. According to The Insider, three other leaders have been identified and are believed to be in Russia. The best practices remain the same:

• Patch exposed equipment first, especially VPNs. In July, Arctic Wolf described intrusions that ended with the deployment of Qilin, and whose entry point was the CVE-2026-0257 vulnerability in PAN-OS GlobalProtect (Palo Alto Networks).
• Protect your backups: according to the same report, the attackers targeted Veeam backup infrastructure before encrypting. Keep at least one offline copy.
• Watch for signs of exfiltration, such as unusual use of Rclone or large uploads to MEGA.
• If you are attacked, file a complaint and get support, for example through Cybermalveillance.gouv.fr (France's national cybercrime victim assistance service).