Japan’s National Police Agency confirmed on Thursday the arrest and extradition of a Russian national accused of being involved in the Qilin ransomware gang.
Japanese officials said they received an arrest warrant from Germany for the 28-year-old Russian national, whose name was not released, for their alleged role in a ransomware attack on a German company. Japan’s Ministry of Justice worked to detain the suspect before they were extradited to Germany.
The news outlet Nippon reported that the operation began in May when officials learned the suspect planned to come to Japan for vacation. He was arrested at a hotel in Osaka that month and sent to Germany in June. German law enforcement did not respond to requests for comment.
The Qilin ransomware gang has been behind dozens of high-profile attacks, including incidents in both Germany and Japan.
The group took credit for an April ransomware attack on German democratic socialist political party Die Linke and another devastating incident last year involving Japanese beverage giant Asahi.
Asahi spent weeks recovering from the attack, which disrupted its order processing, shipping, and customer services. The attackers also leaked Asahi’s financial records, employee data, contracts and development forecasts.
The group faced increased law enforcement scrutiny in 2024 after an attack on a British healthcare company that prompted major disruptions to medical services. It quickly returned with attacks on the government of Palau and one of the largest newspaper chains in the U.S..
Qilin was one of the most active ransomware operations in 2025. targeting Kuala Lumpur International Airport, the Texas city of Sugar Land, and more.
The group has continued to launch damaging attacks in 2026, with researchers saying it was the second most active ransomware gang in July with 127 reported attacks. French rugby club Stade Français Paris confirmed it had been attacked after being added to Qilin’s leak site.
In August, Qilin actors took credit for a ransomware attack on the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The group allegedly stole information about targets of ATF investigations.
