Japan extradites suspected Qilin cybercrime operative to Germany
Japan detained a 28-year-old Russian national in Osaka and handed him to Germany on 2 October, where he is suspected of extorting a German logistics company through a ransomware attack. The Asahi Shimbun reports that he allegedly helped build Qilin’s attack systems; the group claimed responsibility for a 2025 attack that disrupted operations at Japan’s Asahi Group.
Bottom line — The case puts a suspected Qilin infrastructure builder in German custody, but investigators have not linked him personally to the Asahi attack.
Go deeper 5
-
The Asahi Shimbun says the suspect allegedly accessed a German logistics company’s systems in September 2024, stole and encrypted data, then demanded €151,000 ($165,000) in bitcoin.
-
According to the Asahi Shimbun, Japan detained him in late May after obtaining a warrant; the Tokyo High Court later ruled that extradition requirements were met.
-
The Asahi Shimbun reports that the suspect is believed to have built systems used in ransomware attacks and received part of the proceeds in the German case.
-
The Asahi Shimbun says Qilin’s leak site listed 161 victims in August, the highest total among about 370 ransomware groups monitored by Mitsui Bussan Secure Directions.
-
Japan’s National Police Agency recorded 123 ransomware attacks in the first half of this year, the highest half-year total since figures began in 2020, according to the Asahi Shimbun.