A man believed to be a Russian national was detained in Japan and extradited to Germany following an international investigation. The arrest of the man, who is considered to be a leader of Qilin, has been reported as the result of cooperation among law enforcement agencies in multiple countries.
German authorities announced in October 2026 that they had arrested a Russian national believed to have led the Qilin ransomware attack group, and revealed that Japanese police had played an important role. The man was detained while in Japan and extradited to Germany.
Qilin is a cybercrime organization that began operating as Agenda around summer 2022 and later changed its name. It infiltrates the systems of companies and organizations, encrypts their data, and uses double extortion by threatening to publish stolen information. It is reportedly believed to have targeted approximately 4,000 entities worldwide.
In Japan, damage has been confirmed at at least 53 organizations, including manufacturers, medical institutions and educational institutions, since 2023. In 2025, the group publicly claimed responsibility for a large-scale attack on Asahi Group Holdings, which reportedly halted the company’s core factory systems and potentially resulted in the leakage of personal information relating to up to approximately 2 million people.
The arrest is regarded as the result of effective cooperation among international law enforcement agencies in combating cross-border cybercrime. Meanwhile, attacks by Qilin have not stopped, and attention is focused on future developments, including suspected misuse of generative AI and measures to strengthen defenses.