Qilin claims responsibility for a 2025 ransomware attack on Asahi Group Holdings Ltd. on its website. (Provided by a security company)
Japanese investigators detained a core member of the international ransomware group Qilin in Osaka in May and handed over the Russian national to Germany on Oct. 2, sources said.
German authorities, which are investigating the 28-year-old man on suspicion of extortion, had requested his detention and extradition.
Qilin has repeatedly carried out cyberattacks against companies and other organizations around the world.
Last year, the group claimed responsibility for a ransomware attack on Asahi Group Holdings Ltd., which disrupted its order processing and shipment operations.
Law enforcement agencies in Japan, Germany and other countries have been conducting joint investigations.
The handover was carried out under the Extradition Law, which sets rules for transferring fugitives wanted in connection with criminal cases committed abroad.
According to sources, the Russian national is believed to have accessed terminals at a logistics company in Germany in September 2024 and illegally obtained and encrypted data.
He is suspected of having extorted the company by threatening to release the information unless the company paid $165,000 (26 million yen) in bitcoin.
The man is said to have been responsible for building systems used in ransomware attacks.
Investigators said Qilin operates through multiple operational units that carry out ransomware attacks under the direction of core members, such as the suspect.
The ransom payments collected by operational teams are allegedly passed on to the group’s leadership.
Authorities have confirmed that the suspect received part of the proceeds in the case under investigation.
Japanese investigators obtained information the man’s whereabouts in advance.
After securing a warrant from the Tokyo High Court, they detained him in late May while he was traveling in Osaka.
Following a Tokyo High Court ruling that the case met the requirements for extradition, Japan handed the suspect over to Germany.
GANG SAID ‘ONE OF THE MOST ACTIVE’
Ransomware is a type of malicious software that encrypts data on computers and other devices, rendering it unusable until a ransom is paid for restoration.
According to Mika Fukuda, a ransomware expert at Mitsui Bussan Secure Directions Inc., Qilin’s activities have been tracked since around the middle of 2022.
The group posts information victimized companies and organizations on its “leak site.”
The number of listings has recently ranged from dozens to 100 per month.
“Qilin is one of the most active large-scale ransomware groups,” Fukuda said, adding that its activities appear to be expanding globally.
Data compiled by Mitsui Bussan Secure Directions found that Qilin posted information on 161 victims on its leak site in August, the highest number among 370 ransomware groups monitored by the company.
In September, the group listed 75 cases, the second highest.
This year, 14 companies and organizations in Japan appeared on Qilin’s leak site.
Japanese police recorded 123 ransomware attacks during the first half of this year, the highest figure since semiannual statistics began in 2020.
According to the National Police Agency, ransomware cases totaled 226 nationwide last year, with the annual figure hovering around 200 in recent years.
Of the 1,021 cases reported over the past five years, 583 involved small and midsize enterprises, accounting for 60 percent of the total.
Large companies were affected in 310 cases.
A survey of affected companies and organizations found that the most common infection route was through virtual private networks, accounting for half of the cases.
The NPA has reported a growing use of a tactic known as “Ransomware as a Service,” or RaaS.
Under the arrangement, ransomware developers provide malware to cybercriminals who carry out attacks and receive a cut of the ransom in return.
This scheme allows criminals without advanced skills or specialized knowledge to launch sophisticated cyberattacks, resulting in a wider pool of perpetrators.
Qilin is believed to be one of the criminal organizations operating a RaaS provider.
U.S. Marine held in strangulation death of woman in Okinawa hotel
Children study at ‘juken’ camp amid anxiety over future
Kawagoe gives illegal mosque one year to be removed
Odd safety order quietly accepted before fatal Tobu Railway accident
Japan’s only gold leaf producing area struggling for survival
Government guidelines define child abuse from religious parents
Why customers are fine with a Kyoto bank cutting its hours
SoftBank offers AI service for teachers to help troubled children
VOX POPULI: 16 novelists seek inspiration from the rails on night train to Matsue
Subsidy to lower electricity prices in households by 20% planned
Eased blood ban at Jehovah’s Witnesses called insufficient
U.S. Marine held in strangulation death of woman in Okinawa hotel
Kawagoe gives illegal mosque one year to be removed
Children study at ‘juken’ camp amid anxiety over future
Central Tokyo sets record with 34th consecutive day of rain
Takaichi’s call to delete ‘enemy states clause’ adds fuel to fire
Tokyo’s wealth, drawing power raise insecurity among neighbors
In ever-shrinking Japan, foreign resident numbers hit a record high
Rare role model: Volleyball player Rui Takahashi comes out as gay
After risking his life for Japan, Afghan struggles to get by
Ozegahara wetland glows in golden hues of autumn grasses October 6, 2026
Ozegahara wetland glows in golden hues of autumn grasses
What does it take to become a pro whistler and world champion? October 3, 2026
What does it take to become a pro whistler and world champion?
First heart patch transplant moves iPS therapy from lab to clinic September 30, 2026
First heart patch transplant moves iPS therapy from lab to clinic
YOASOBI A peek through the music industry’s curtain at the producers who harnessed social media to help their idols go global.
A peek through the music industry’s curtain at the producers who harnessed social media to help their idols go global.
Diplomatic Documents A series based on diplomatic documents declassified by Japan’s Foreign Ministry
A series based on diplomatic documents declassified by Japan’s Foreign Ministry
Memories of Hiroshima and Nagasaki Here is a collection of first-hand accounts by “hibakusha” atomic bomb survivors.
Here is a collection of first-hand accounts by “hibakusha” atomic bomb survivors.
Taste of Life Cooking experts, chefs and others involved in the field of food introduce their special recipes intertwined with their paths in life.
Cooking experts, chefs and others involved in the field of food introduce their special recipes intertwined with their paths in life.
Memories of Nikkei Americans A series Japanese-Americans and their memories of World War II
A series Japanese-Americans and their memories of World War II
In-house News and Messages
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
