Germany extradites alleged Qilin ransomware leader from Japan

Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group after the suspect was extradited from Japan earlier this month. Japan’s National Police Agency confirmed the extradition and said the suspect was detained after arriving in Japan as a tourist.

Japanese authorities said they worked with Germany to detain the suspect under Japan’s Extradition Law for Fugitives, then facilitated the extradition. The statement was machine translated in the source report. Japanese media had reported the arrest earlier, citing internal sources.

Qilin, formerly known as Agenda, emerged in August 2022 as a ransomware-as-a-service operation. It uses double-extortion attacks, stealing data before encrypting it. The group has targeted more than 2,350 known organizations across 62 countries, according to statistics cited in the report. Victims named include Nissan, Asahi, Lee Enterprises and Court Services Victoria. An attack on Asahi disrupted operations for an extended period and exposed sensitive details about about 1.5 million people.

Media reports said Japan detained the alleged member at an Osaka hotel in May. Since June, Qilin has listed more than 450 victims on its data leak site, according to the report.