Rare occurrence: Japan extradites ransomware suspect to Germany

Japan rarely extradites accused individuals to countries with which it has no extradition treaty. It only has such treaties with South Korea and the USA. In the case of a Russian national, Japan is now making a rare exception: he was extradited to Germany in early October, where he faces prosecution. The 28-year-old is suspected of being a key member of Qilin. Qilin has recently become one of the most active ransomware gangs; the arrested individual is said to have been responsible for programming the software.

It was not publicly known that Qilin successfully infiltrated the IT systems of a German logistics company in September 2024 and extorted money from it. To avoid the publication of the stolen data, the company paid a ransom in Bitcoin, part of which allegedly went to the suspect, reports the Japanese newspaper Asahi Shimbun. The German arrest warrant is said to be based on this suspicion. In March, the Left Party became a victim of Qilin .

Special investigators reportedly knew in advance that the wanted person would travel to Japan. Therefore, they obtained confirmation of the German arrest warrant from the Tokyo High Court. This allowed the man to be arrested in Osaka in May. According to the report, he is accused not only of being a programmer but also of being a direct perpetrator; he is said to have manipulated the systems of the German company himself.

The Qilin gang operates internationally, including in Japan. a year ago, the large brewery Asahi was attacked there, which triggered delivery problems for beer on the island. Competitors could not compensate for Asahi’s production downtime. The production of non-alcoholic beverages and other food products was also affected.

Therefore, it is particularly surprising that Japan extradited the Russian to Germany. This is generally rare: in some years, there are no extraditions without an extradition treaty at all, according to the German-language website Japan Sumikai , and in other years only isolated cases. Furthermore, Japanese extradition law prohibits the extradition of suspects who are to be prosecuted in Japan or who have not yet served their sentence.

It is unclear why Japan is not using the German evidence for a prosecution based on the attack on the Asahi brewery. It is conceivable that the German indictment is already ready, but the investigations in Japan are still ongoing. After all, the German attack occurred longer ago than the Japanese one. The German connection might be stronger due to the alleged money flow, and the potential penalty higher. Perhaps Germany also agreed to the repatriation at a later date.

Note: The brewery and the mentioned newspaper are not the same company, even though both have Asahi in their name. Asahi means “morning sun” or “rising sun”. There are numerous geographic features, ships, companies, and other entities named “Asahi” in Japan, as the sun plays a special role in Japanese culture. A Linux distribution for ARM Macs is also called “Asahi” .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.