German authorities now hold a 28-year-old Russian described as one of Qilin's leading heads in a German prison, Japan Cyber Watch reports. North Rhine-Westphalia ministers Herbert Reul and Benjamin Limbach announced the custody transfer on Oct.
7, 2026 after his detention in Japan. Qilin is a ransomware operation in which core members build the systems used for crimes. Operational teams conduct attacks and route ransom payments to the core, Japan Cyber Watch reports.
Table of Contents
- How did Japan detain and transfer the suspect?
- What German case does he face?
- How large is Qilin's alleged operation?
- Has the arrest stopped Qilin?
How did Japan detain and transfer the suspect?
Japanese investigators detained the man in Osaka in late May 2026 while he traveled as a tourist. They acted on a Tokyo High Court warrant after learning his whereabouts in advance. Japan Cyber Watch describes the move in its detailed account of the detention and handover. Japan held him under a provisional detention permit under the Act of Extradition at Germany's request.
Japan has no extradition treaty with Germany, Japan Cyber Watch reports. The Tokyo High Court later ruled extradition permissible. Japan handed him to German custody on Oct. 2, 2026 with help from the Justice Ministry, the Tokyo High Public Prosecutors Office and officials. BleepingComputer reports the handover in its report on the arrest after extradition.
What German case does he face?
German investigators accuse him over a September 2024 intrusion into a logistics company in North Rhine-Westphalia. The attack involved data theft, encryption and extortion of about $165,000 in Bitcoin.
Investigators say he received part of that payment, according to SecurityWeek in its coverage of the case against the suspect. He is described as a core Qilin member responsible for building the systems used for crimes. Operational teams conduct attacks and route ransom payments through to the core, Japan Cyber Watch reports.
How large is Qilin's alleged operation?
NRW's State Criminal Police Office and Central Cybercrime Unit secretly infiltrated Qilin for months. NRW says Qilin extorted nearly 4,000 organizations since 2024. The group demanded nearly $3 billion and received over $140 million, according to B2B Cyber Security in its account of NRW's infiltration findings.
The figures show high pressure on victims and steady income for operators. Even a small share of paid demands can fund new attacks and infrastructure. That scale explains why investigators treat the case as larger than one company intrusion.
Has the arrest stopped Qilin?
The arrest has not stopped Qilin. No official source ties this suspect to the 2025 Asahi Group attack.
Reporting notes continued Qilin victim claims, Japan Cyber Watch reports. Defenders should keep ransomware controls in place while the international joint investigation continues. Focus on steps that limit both data theft and encryption.
- Treat Qilin as active and watch for new victim reports
- Keep offline backups and test restoration for encrypted systems
- Limit lateral movement to slow data theft and encryption
You Might Also Like
- Royal Ransomware Update 2026: Disclosure, Response, and Open Questions
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit
- Double Extortion Ransomware Guide 2026: What Happened, Who Is Affected, and Next Steps